CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2005-1688 – WordPress Core < 1.5.1 - Full Path Disclosure
https://notcve.org/view.php?id=CVE-2005-1688
Wordpress 1.5 and earlier allows remote attackers to obtain sensitive information via a direct request to files in (1) wp-content/themes/, (2) wp-includes/, or (3) wp-admin/, which reveal the path in an error message. • http://marc.info/?l=bugtraq&m=111661517716733&w=2 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-425: Direct Request ('Forced Browsing') •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2005-1102 – WordPress Core <= 1.5 - Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2005-1102
Multiple cross-site scripting (XSS) vulnerabilities in template-functions-post.php in WordPress 1.5 and earlier allow remote attackers to execute arbitrary commands via the (1) content or (2) title of the post. • http://bugs.gentoo.org/show_bug.cgi?id=88926 http://marc.info/?l=bugtraq&m=111336102101571&w=2 http://security.gentoo.org/glsa/glsa-200506-04.xml http://wordpress.org/support/topic.php?id=30721 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •