National Vulnerability Database

National Vulnerability Database

National Vulnerability
Database

Search Results (Refine Search)

Search Parameters:
  • Results Type: Overview
  • Search Type: Search All
  • Keyword (text search): wordpress
There are 2,721 matching records.
Displaying matches 2441 through 2460.
Vuln ID Summary CVSS Severity
CVE-2010-3977

Multiple cross-site scripting (XSS) vulnerabilities in wp-content/plugins/cforms/lib_ajax.php in cforms WordPress plugin 11.5 allow remote attackers to inject arbitrary web script or HTML via the (1) rs and (2) rsargs[] parameters.

Published: November 03, 2010; 09:37:09 AM -04:00
    V2: 4.3 MEDIUM
CVE-2010-0405

Integer overflow in the BZ2_decompress function in decompress.c in bzip2 and libbzip2 before 1.0.6 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted compressed file.

Published: September 28, 2010; 02:00:02 PM -04:00
    V2: 5.1 MEDIUM
CVE-2010-2924

SQL injection vulnerability in myLDlinker.php in the myLinksDump Plugin 1.2 for WordPress allows remote attackers to execute arbitrary SQL commands via the url parameter. NOTE: some of these details are obtained from third party information.

Published: July 30, 2010; 04:30:04 PM -04:00
    V2: 7.5 HIGH
CVE-2010-1855

SQL injection vulnerability in auktion.php in Pay Per Watch & Bid Auktions System allows remote attackers to execute arbitrary SQL commands via the id_auk parameter.

Published: May 07, 2010; 04:30:01 PM -04:00
    V2: 7.5 HIGH
CVE-2010-1365

SQL injection vulnerability in index.php in Uiga Fan Club, as downloaded on 20100310, allows remote attackers to execute arbitrary SQL commands via the id parameter in a photos action.

Published: April 13, 2010; 04:30:00 PM -04:00
    V2: 7.5 HIGH
CVE-2010-1148

The cifs_create function in fs/cifs/dir.c in the Linux kernel 2.6.33.2 and earlier allows local users to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact via a NULL nameidata (aka nd) field in a POSIX file-creation request to a server that supports UNIX extensions.

Published: April 12, 2010; 01:30:00 PM -04:00
    V2: 4.7 MEDIUM
CVE-2010-1338

SQL injection vulnerability in ts_other.php in the Teamsite Hack plugin 3.0 and earlier for WoltLab Burning Board allows remote attackers to execute arbitrary SQL commands via the userid parameter in a modboard action.

Published: April 09, 2010; 02:30:00 PM -04:00
    V2: 7.5 HIGH
CVE-2010-1186

Cross-site scripting (XSS) vulnerability in xml/media-rss.php in the NextGEN Gallery plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the mode parameter.

Published: April 07, 2010; 11:30:00 AM -04:00
    V2: 4.3 MEDIUM
CVE-2010-1271

SQL injection vulnerability in showplugs.php in smartplugs 1.3 allows remote attackers to execute arbitrary SQL commands via the domain parameter.

Published: April 06, 2010; 12:30:00 PM -04:00
    V2: 7.5 HIGH
CVE-2010-0751

The ip_evictor function in ip_fragment.c in libnids 1.24, as used in dsniff and possibly other products, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via crafted fragmented packets.

Published: April 06, 2010; 12:30:00 PM -04:00
    V2: 5.0 MEDIUM
CVE-2010-1270

SQL injection vulnerability in auktion.php in Multi Auktions Komplett System 2 allows remote attackers to execute arbitrary SQL commands via the id_auk parameter.

Published: April 06, 2010; 11:30:00 AM -04:00
    V2: 7.5 HIGH
CVE-2010-1269

SQL injection vulnerability in auktion.php in phpscripte24 Niedrig Gebote Pro Auktions System II allows remote attackers to execute arbitrary SQL commands via the id_auk parameter.

Published: April 06, 2010; 11:30:00 AM -04:00
    V2: 7.5 HIGH
CVE-2009-4748

SQL injection vulnerability in mycategoryorder.php in the My Category Order plugin 2.8 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the parentID parameter in an act_OrderCategories action to wp-admin/post-new.php.

Published: March 26, 2010; 04:30:00 PM -04:00
    V2: 7.5 HIGH
CVE-2010-1094

SQL injection vulnerability in news.php in DZ EROTIK Auktionshaus V4rgo allows remote attackers to execute arbitrary SQL commands via the id parameter.

Published: March 24, 2010; 06:44:14 PM -04:00
    V2: 7.5 HIGH
CVE-2010-1072

Cross-site scripting (XSS) vulnerability in search.php in Sniggabo CMS 2.21 allows remote attackers to inject arbitrary web script or HTML via the q parameter.

Published: March 23, 2010; 02:30:00 PM -04:00
    V2: 4.3 MEDIUM
CVE-2010-0980

SQL injection vulnerability in player.php in Left 4 Dead (L4D) Stats 1.1 allows remote attackers to execute arbitrary SQL commands via the steamid parameter.

Published: March 16, 2010; 03:30:00 PM -04:00
    V2: 7.5 HIGH
CVE-2010-0973

SQL injection vulnerability in index.php in phppool media Domain Verkaus and Auktions Portal allows remote attackers to execute arbitrary SQL commands via the id parameter.

Published: March 16, 2010; 03:00:00 PM -04:00
    V2: 7.5 HIGH
CVE-2010-0964

SQL injection vulnerability in start.php in Eros Webkatalog allows remote attackers to execute arbitrary SQL commands via the id parameter in a rubrik action.

Published: March 16, 2010; 03:00:00 PM -04:00
    V2: 7.5 HIGH
CVE-2010-0955

SQL injection vulnerability in index.php in Bild Flirt Community 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.

Published: March 10, 2010; 03:14:34 PM -05:00
    V2: 7.5 HIGH
CVE-2009-4672

Directory traversal vulnerability in main.php in the WP-Lytebox plugin 1.3 for WordPress allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the pg parameter.

Published: March 05, 2010; 01:30:00 PM -05:00
    V2: 7.5 HIGH