National Vulnerability Database

National Vulnerability Database

National Vulnerability
Database

Search Results (Refine Search)

Search Parameters:
  • Results Type: Overview
  • Search Type: Search All
  • Keyword (text search): wordpress
There are 2,046 matching records.
Displaying matches 1781 through 1800.
Vuln ID Summary CVSS Severity
CVE-2010-0980

SQL injection vulnerability in player.php in Left 4 Dead (L4D) Stats 1.1 allows remote attackers to execute arbitrary SQL commands via the steamid parameter.

Published: March 16, 2010; 03:30:00 PM -04:00
V2: 7.5 HIGH
CVE-2010-0973

SQL injection vulnerability in index.php in phppool media Domain Verkaus and Auktions Portal allows remote attackers to execute arbitrary SQL commands via the id parameter.

Published: March 16, 2010; 03:00:00 PM -04:00
V2: 7.5 HIGH
CVE-2010-0964

SQL injection vulnerability in start.php in Eros Webkatalog allows remote attackers to execute arbitrary SQL commands via the id parameter in a rubrik action.

Published: March 16, 2010; 03:00:00 PM -04:00
V2: 7.5 HIGH
CVE-2010-0955

SQL injection vulnerability in index.php in Bild Flirt Community 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.

Published: March 10, 2010; 03:14:34 PM -05:00
V2: 7.5 HIGH
CVE-2009-4672

Directory traversal vulnerability in main.php in the WP-Lytebox plugin 1.3 for WordPress allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the pg parameter.

Published: March 05, 2010; 01:30:00 PM -05:00
V2: 7.5 HIGH
CVE-2010-0723

SQL injection vulnerability in news.php in Ero Auktion 2.0 and 2010 allows remote attackers to execute arbitrary SQL commands via the id parameter.

Published: February 26, 2010; 03:30:00 PM -05:00
V2: 7.5 HIGH
CVE-2010-0722

SQL injection vulnerability in news.php in Php Auktion Pro allows remote attackers to execute arbitrary SQL commands via the id parameter.

Published: February 26, 2010; 03:30:00 PM -05:00
V2: 7.5 HIGH
CVE-2010-0720

SQL injection vulnerability in news.php in Erotik Auktionshaus allows remote attackers to execute arbitrary SQL commands via the id parameter.

Published: February 26, 2010; 03:30:00 PM -05:00
V2: 7.5 HIGH
CVE-2010-0713

Multiple cross-site request forgery (CSRF) vulnerabilities in Zenoss 2.3.3, and other versions before 2.5, allow remote attackers to hijack the authentication of an administrator for (1) requests that reset user passwords via zport/dmd/ZenUsers/admin, and (2) requests that change user commands, which allows for remote execution of system commands via zport/dmd/userCommands/.

Published: February 26, 2010; 12:30:01 PM -05:00
V2: 6.8 MEDIUM
CVE-2010-0712

Multiple SQL injection vulnerabilities in zport/dmd/Events/getJSONEventsInfo in Zenoss 2.3.3, and other versions before 2.5, allow remote authenticated users to execute arbitrary SQL commands via the (1) severity, (2) state, (3) filter, (4) offset, and (5) count parameters.

Published: February 26, 2010; 12:30:01 PM -05:00
V2: 6.5 MEDIUM
CVE-2010-0682

WordPress 2.9 before 2.9.2 allows remote authenticated users to read trash posts from other authors via a direct request with a modified p parameter.

Published: February 23, 2010; 03:30:00 PM -05:00
V2: 4.0 MEDIUM
CVE-2010-0673

SQL injection vulnerability in cplphoto.php in the Copperleaf Photolog plugin 0.16, and possibly earlier, for WordPress allows remote attackers to execute arbitrary SQL commands via the postid parameter.

Published: February 22, 2010; 03:30:00 PM -05:00
V2: 7.5 HIGH
CVE-2009-4587

Cherokee Web Server 0.5.4 allows remote attackers to cause a denial of service (daemon crash) via an MS-DOS reserved word in a URI, as demonstrated by the AUX reserved word.

Published: January 07, 2010; 01:30:00 PM -05:00
V2: 5.0 MEDIUM
CVE-2009-4424

SQL injection vulnerability in results.php in the Pyrmont plugin 2 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.

Published: December 28, 2009; 02:00:00 PM -05:00
V2: 7.5 HIGH
CVE-2009-4140

Unrestricted file upload vulnerability in ofc_upload_image.php in Open Flash Chart v2 Beta 1 through v2 Lug Wyrm Charmer, as used in Piwik 0.2.35 through 0.4.3, Woopra Analytics Plugin before 1.4.3.2, and possibly other products, when register_globals is enabled, allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension through the name parameter with the code in the HTTP_RAW_POST_DATA parameter, then accessing it via a direct request to the file in tmp-upload-images/.

Published: December 22, 2009; 05:30:00 PM -05:00
V2: 7.5 HIGH
CVE-2009-3703

Multiple SQL injection vulnerabilities in the WP-Forum plugin before 2.4 for WordPress allow remote attackers to execute arbitrary SQL commands via (1) the search_max parameter in a search action to the default URI, related to wpf.class.php; (2) the forum parameter to an unspecified component, related to wpf.class.php; (3) the topic parameter in a viewforum action to the default URI, related to the remove_topic function in wpf.class.php; or the id parameter in a (4) editpost or (5) viewtopic action to the default URI, related to wpf-post.php.

Published: December 18, 2009; 02:30:00 PM -05:00
V2: 7.5 HIGH
CVE-2009-4170

WP-Cumulus Plug-in 1.20 for WordPress, and possibly other versions, allows remote attackers to obtain sensitive information via a crafted request to wp-cumulus.php, probably without parameters, which reveals the installation path in an error message.

Published: December 02, 2009; 01:30:00 PM -05:00
V2: 5.0 MEDIUM
CVE-2009-4169

Cross-site scripting (XSS) vulnerability in wp-cumulus.php in the WP-Cumulus Plug-in before 1.22 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Published: December 02, 2009; 01:30:00 PM -05:00
V2: 4.3 MEDIUM
CVE-2009-4168

Cross-site scripting (XSS) vulnerability in Roy Tanck tagcloud.swf, as used in the WP-Cumulus plugin before 1.23 for WordPress and the Joomulus module 2.0 and earlier for Joomla!, allows remote attackers to inject arbitrary web script or HTML via the tagcloud parameter in a tags action. Cross-site scripting (XSS) vulnerability in tagcloud.swf in the WP-Cumulus Plug-in before 1.23 for WordPress allows remote attackers to inject arbitrary web script or HTML via the tagcloud parameter.

Published: December 02, 2009; 01:30:00 PM -05:00
V2: 4.3 MEDIUM
CVE-2009-3891

Cross-site scripting (XSS) vulnerability in wp-admin/press-this.php in WordPress before 2.8.6 allows remote authenticated users to inject arbitrary web script or HTML via the s parameter (aka the selection variable).

Published: November 17, 2009; 01:30:00 PM -05:00
V2: 3.5 LOW