CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 2CVE-2011-3859 – Trending < 0.2 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2011-3859
Cross-site scripting (XSS) vulnerability in the Trending theme before 0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cpage parameter. vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en el tema Trending anteriores a v0.2 para WordPress, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro cpage. • https://www.exploit-db.com/exploits/36195 https://sitewat.ch/en/Advisories/17 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2012-1067 – WP-RecentComments <= 2.0.7 - SQL Injection
https://notcve.org/view.php?id=CVE-2012-1067
SQL injection vulnerability in the WP-RecentComments plugin 2.0.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter in an rc-content action to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Vulnerabilidad de inyección SQL en el complemento WP-RecentComments v2.0.7 para WordPress, permite a atacantes remotos ejecutar comandos SQL de su elección a través del parámetro id en una acción rc-content en index.php. NOTA: la procedencia de esta información es desconocida, los detalles se han obtenido únicamente de información de terceros. SQL injection vulnerability in the WP-RecentComments plugin 2.0.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter in an rc-content action to index.php. • http://osvdb.org/78820 http://secunia.com/advisories/47870 http://www.securityfocus.com/bid/51859 https://exchange.xforce.ibmcloud.com/vulnerabilities/72951 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 12EXPL: 0CVE-2012-1068 – WP-RecentComments <= 2.0.6 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2012-1068
Cross-site scripting (XSS) vulnerability in the rc_ajax function in core.php in the WP-RecentComments plugin before 2.0.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter, related to AJAX paging. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en la función rc_ajax en core.php en el complemento WP-RecentComments v2.0.7 para WordPress, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro page, relacionado con la paginación AJAX. • http://plugins.trac.wordpress.org/changeset/416723/wp-recentcomments/trunk/core.php?old=316325&old_path=wp-recentcomments%2Ftrunk%2Fcore.php http://secunia.com/advisories/46141 http://wordpress.org/extend/plugins/wp-recentcomments/changelog http://www.osvdb.org/75635 http://www.securityfocus.com/bid/49734 https://exchange.xforce.ibmcloud.com/vulnerabilities/70003 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 1%CPEs: 4EXPL: 3CVE-2012-1205 – Relocate Upload < 0.20 - Remote File Inclusion
https://notcve.org/view.php?id=CVE-2012-1205
PHP remote file inclusion vulnerability in relocate-upload.php in Relocate Upload plugin before 0.20 for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the abspath parameter. Una vulnerabilidad de inclusión de archivo PHP remota en relocate-upload.php en el complemento 'Relocate Upload' para Wordpress antes de v0.20 permite a atacantes remotos ejecutar código PHP de su elección a través de una URL en el parámetro abspath. • https://www.exploit-db.com/exploits/17869 http://osvdb.org/79250 http://plugins.trac.wordpress.org/changeset/504380/relocate-upload http://secunia.com/advisories/47976 http://wordpress.org/extend/plugins/relocate-upload/changelog http://www.securityfocus.com/bid/49693 • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') •
CVSS: 9.8EPSS: 3%CPEs: 2EXPL: 2CVE-2011-3981 – AllWebMenus WordPress Menu Plugin <= 1.1.3 - Remote File Inclusion
https://notcve.org/view.php?id=CVE-2011-3981
PHP remote file inclusion vulnerability in actions.php in the Allwebmenus plugin 1.1.3 for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the abspath parameter. Vulnerabilidad de inclusión de PHP remoto en actions.php en el plugin AllWebMenus v1.1.3 para WordPress. Permite a atacantes remotos ejecutar código PHP arbitrario a través de una URL en el parámetro abspath. • https://www.exploit-db.com/exploits/17861 http://plugins.trac.wordpress.org/changeset/438959/allwebmenus-wordpress-menu-plugin/trunk/actions.php?old=408304&old_path=allwebmenus-wordpress-menu-plugin%2Ftrunk%2Factions.php http://secunia.com/advisories/46068 http://www.exploit-db.com/exploits/17861 http://www.securityfocus.com/bid/49685 https://exchange.xforce.ibmcloud.com/vulnerabilities/69929 • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') •