CVSS: 9.8EPSS: 4%CPEs: 19EXPL: 1CVE-2007-0233 – WordPress Core < 2.0.7 - SQL Injection
https://notcve.org/view.php?id=CVE-2007-0233
13 Jan 2007 — wp-trackback.php in WordPress 2.0.6 and earlier does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary SQL commands via the tb_id parameter. NOTE: it could be argued that this vulnerability is due to a bug in the unset PHP command (CVE-2006-3017) and the proper fix should be in PHP; if so, then this should not be treated as a vulnerability in WordPress. wp-trackback.ph... • https://www.exploit-db.com/exploits/3109 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 2CVE-2007-0107 – WordPress Core <= 2.0.5 - SQL Injection
https://notcve.org/view.php?id=CVE-2007-0107
05 Jan 2007 — WordPress before 2.0.6, when mbstring is enabled for PHP, decodes alternate character sets after escaping the SQL query, which allows remote attackers to bypass SQL injection protection schemes and execute arbitrary SQL commands via multibyte charsets, as demonstrated using UTF-7. WordPress anterior a 2.0.6, cuando mbstring está habilitado para PHP, decodifica juegos de caracteres alternativos tras escapar la petición SQL, lo cual permite a atacantes remotos evitar los esquemas de protección contra inyecció... • https://www.exploit-db.com/exploits/3095 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0CVE-2007-0106 – WordPress Core <= 2.0.5 - Cross-Site Request Forgery to Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2007-0106
05 Jan 2007 — Cross-site scripting (XSS) vulnerability in the CSRF protection scheme in WordPress before 2.0.6 allows remote attackers to inject arbitrary web script or HTML via a CSRF attack with an invalid token and quote characters or HTML tags in URL variable names, which are not properly handled when WordPress generates a new link to verify the request. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en el esquema de protección ante CSRF de WordPress anterior a 2.0.6 permite a atacantes remotos iny... • http://osvdb.org/33397 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.5EPSS: 1%CPEs: 6EXPL: 0CVE-2007-0109 – WordPress < 2.0.6 - Username Enumeration via Error Messages
https://notcve.org/view.php?id=CVE-2007-0109
05 Jan 2007 — wp-login.php in WordPress 2.0.5 and earlier displays different error messages if a user exists or not, which allows remote attackers to obtain sensitive information and facilitates brute force attacks. wp-login.php en WordPress 2.0.5 y anteriores muestra diferentes mensajes de error si un usuario existe o no, lo cual permite a atacantes remotos obtener información sensible y facilita ataques de fuerza bruta. • http://osvdb.org/31577 • CWE-204: Observable Response Discrepancy •
CVSS: 6.8EPSS: 2%CPEs: 18EXPL: 2CVE-2006-6808 – WordPress Core <= 2.0.5 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2006-6808
28 Dec 2006 — Cross-site scripting (XSS) vulnerability in wp-admin/templates.php in WordPress 2.0.5 allows remote attackers to inject arbitrary web script or HTML via the file parameter. NOTE: some sources have reported this as a vulnerability in the get_file_description function in wp-admin/admin-functions.php. Vulnerabilidad de XSS en wp-admin/templates.php en WordPress 2.0.5 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro de archivo. NOTA: algunas fuentes han i... • https://www.exploit-db.com/exploits/29356 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2006-6017 – WordPress Core <= 2.0.4 - Denial of Service
https://notcve.org/view.php?id=CVE-2006-6017
27 Oct 2006 — WordPress before 2.0.5 does not properly store a profile containing a string representation of a serialized object, which allows remote authenticated users to cause a denial of service (application crash) via a string that represents a (1) malformed or (2) large serialized object, because the object triggers automatic unserialization for display. WordPress anterior a 2.0.5 no almacena adecuadamente un perfil que contiene una representación de un objeto serializado en una cadena, lo cual permite a usuarios r... • http://bugs.gentoo.org/show_bug.cgi?id=153303 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 8.2EPSS: 0%CPEs: 4EXPL: 0CVE-2006-4743 – WordPress Core 2.0.2 - 2.0.5 - Sensitive Information Disclosure
https://notcve.org/view.php?id=CVE-2006-4743
13 Sep 2006 — WordPress 2.0.2 through 2.0.5 allows remote attackers to obtain sensitive information via a direct request for (1) 404.php, (2) akismet.php, (3) archive.php, (4) archives.php, (5) attachment.php, (6) blogger.php, (7) comments.php, (8) comments-popup.php, (9) dotclear.php, (10) footer.php, (11) functions.php, (12) header.php, (13) hello.php, (14) wp-content/themes/default/index.php, (15) links.php, (16) livejournal.php, (17) mt.php, (18) page.php, (19) rss.php, (20) searchform.php, (21) search.php, (22) side... • http://www.securityfocus.com/archive/1/445374/100/0/threaded • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •