CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2005-1688 – WordPress Core < 1.5.1 - Full Path Disclosure
https://notcve.org/view.php?id=CVE-2005-1688
Wordpress 1.5 and earlier allows remote attackers to obtain sensitive information via a direct request to files in (1) wp-content/themes/, (2) wp-includes/, or (3) wp-admin/, which reveal the path in an error message. • http://marc.info/?l=bugtraq&m=111661517716733&w=2 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-425: Direct Request ('Forced Browsing') •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2005-1102 – WordPress Core <= 1.5 - Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2005-1102
Multiple cross-site scripting (XSS) vulnerabilities in template-functions-post.php in WordPress 1.5 and earlier allow remote attackers to execute arbitrary commands via the (1) content or (2) title of the post. • http://bugs.gentoo.org/show_bug.cgi?id=88926 http://marc.info/?l=bugtraq&m=111336102101571&w=2 http://security.gentoo.org/glsa/glsa-200506-04.xml http://wordpress.org/support/topic.php?id=30721 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2003-1598 – WordPress Core < 0.72 - SQL Injection
https://notcve.org/view.php?id=CVE-2003-1598
SQL injection vulnerability in log.header.php in WordPress 0.7 and earlier allows remote attackers to execute arbitrary SQL commands via the posts variable. Una vulnerabilidad de inyección SQL en el archivo log.header.php en WordPress versión 0.7 y anteriores, permite a los atacantes remotos ejecutar comandos SQL arbitrarios por medio de la variable posts. • http://osvdb.org/show/osvdb/4610 http://seclists.org/oss-sec/2012/q1/77 http://secunia.com/advisories/8954 http://www.kernelpanik.org/docs/kernelpanik/wordpressadv.txt http://www.securityfocus.com/bid/7784 https://exchange.xforce.ibmcloud.com/vulnerabilities/12204 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •