CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2005-1102 – WordPress Core <= 1.5 - Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2005-1102
Multiple cross-site scripting (XSS) vulnerabilities in template-functions-post.php in WordPress 1.5 and earlier allow remote attackers to execute arbitrary commands via the (1) content or (2) title of the post. • http://bugs.gentoo.org/show_bug.cgi?id=88926 http://marc.info/?l=bugtraq&m=111336102101571&w=2 http://security.gentoo.org/glsa/glsa-200506-04.xml http://wordpress.org/support/topic.php?id=30721 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 1CVE-2003-1599 – WordPress Core <= 0.70 - Remote File Inclusion
https://notcve.org/view.php?id=CVE-2003-1599
PHP remote file inclusion vulnerability in wp-links/links.all.php in WordPress 0.70 allows remote attackers to execute arbitrary PHP code via a URL in the $abspath variable. Una vulnerabilidad de inclusión de archivo PHP remota en archivo wp-links/links.all.php en WordPress versión 0.70, permite a los atacantes remotos ejecutar código PHP arbitrario por medio de una URL en la variable $abspath. • http://www.kernelpanik.org/docs/kernelpanik/wordpressadv.txt http://www.openwall.com/lists/oss-security/2012/01/06/3 http://www.osvdb.org/4611 http://www.securityfocus.com/bid/7785 https://exchange.xforce.ibmcloud.com/vulnerabilities/12205 • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') •