CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2015-9296 – Download Monitor < 1.7.1 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2015-9296
The download-monitor plugin before 1.7.1 for WordPress has XSS related to add_query_arg. El complemento download-monitor versiones anteriores a 1.7.1 para WordPress tiene XSS relacionado con add_query_arg • https://wordpress.org/plugins/download-monitor/#developers • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 8EXPL: 0CVE-2013-5098 – Download Monitor < 3.3.6.2 - Cross-Site Scripting via sort Parameter
https://notcve.org/view.php?id=CVE-2013-5098
Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the sort parameter, a different vulnerability than CVE-2013-3262. Vulnerabilidad Cross-site scripting (XSS) en admin/admin.php en el plugin Download Monitor anterior a v3.3.6.2 para WordPress, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro “sort”, una vulnerabilidad diferente de CVE-2013-3262. • http://plugins.trac.wordpress.org/changeset/723187/download-monitor http://secunia.com/advisories/53116 http://www.securityfocus.com/bid/61407 https://exchange.xforce.ibmcloud.com/vulnerabilities/85921 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 8EXPL: 1CVE-2013-3262 – Download Monitor < 3.3.6.2 - Cross-Site Scripting via p Parameter
https://notcve.org/view.php?id=CVE-2013-3262
Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the p parameter. Vulnerabilidad Cross-site scripting (XSS) en admin/admin.php en el plugin Download Monitor anterior a v3.3.6.2 para WordPress, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro “p”. • http://plugins.trac.wordpress.org/changeset/723187/download-monitor http://secunia.com/advisories/53116 http://www.securityfocus.com/bid/61407 https://exchange.xforce.ibmcloud.com/vulnerabilities/85921 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 3CVE-2012-4768 – Download Monitor <= 3.3.5.8 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2012-4768
Cross-site scripting (XSS) vulnerability in the Download Monitor plugin before 3.3.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the dlsearch parameter to the default URI. Vulnerabilidad de XSS en el plugin Download Monitor anterior a 3.3.5.9 para WordPress permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro dlsearch en la URI por defecto. Wordpress Download Monitor version 3.3.5.7 suffers from a cross site scripting vulnerability. • https://www.exploit-db.com/exploits/37787 http://archives.neohapsis.com/archives/bugtraq/2012-09/0042.html http://osvdb.org/85319 http://packetstormsecurity.org/files/116408/wpdownloadmonitor3357-xss.txt http://secunia.com/advisories/50511 http://www.reactionpenetrationtesting.co.uk/wordpress-download-monitor-xss.html https://exchange.xforce.ibmcloud.com/vulnerabilities/78422 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •