kacper szurek vulnerabilities and exploits

(subscribe to this query)

NA

Cross-site scripting (XSS) vulnerability in admin.php in the Shareaholic plugin prior to 7.6.1.0 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the location[id] parameter in a shareaholic_add_location action to wp-admin/admin-ajax.php.

Shareaholic Shareaholic

1 EDB exploit

NA

Directory traversal vulnerability in services/getfile.php in the Paid Memberships Pro plugin prior to 1.7.15 for WordPress allows remote malicious users to read arbitrary files via a .. (dot dot) in the QUERY_STRING in a getfile action to wp-admin/admin-ajax.php.

Strangerstudios Paid Memberships Pro

1 EDB exploit

8.8

CVSSv3

Unrestricted File Upload vulnerability in Photo Gallery 1.2.5.

10web Photo Gallery 1.2.5

1 EDB exploit

9.8

CVSSv3

Zoho ManageEngine Desktop Central before build 100092 allows remote malicious users to execute arbitrary code via vectors involving the upload of help desk videos.

Zohocorp Manageengine Desktop Central

1 EDB exploit

NA

bb_func_unsub.php in MiniBB 3.1 prior to 20141127 uses an incorrect regular expression, which allows remote malicious users to conduct SQl injection attacks via the code parameter in an unsubscribe action to index.php.

Minibb Minibb

1 EDB exploit

NA

The sanitize function in Codoforum 2.5.1 does not properly implement filtering for directory traversal sequences, which allows remote malicious users to read arbitrary files via a .. (dot dot) in the path parameter to index.php.

Codologic Codoforum 2.5.1

1 EDB exploit

NA

Multiple SQL injection vulnerabilities in the WonderPlugin Audio Player plugin prior to 2.1 for WordPress allow (1) remote authenticated users to execute arbitrary SQL commands via the item[id] parameter in a wonderplugin_audio_save_item action to wp-admin/admin-ajax.php or remot...

Wonderplugin Audio Player

1 EDB exploit

NA

SQL injection vulnerability in ajax/getDropdownValue.php in GLPI prior to 0.85.1 allows remote authenticated users to execute arbitrary SQL commands via the condition parameter.

Glpi-project Glpi

1 EDB exploit

NA

WordPress Download Manager plugin version 2.7.2 suffers from a privilege escalation vulnerability.

8.2

CVSSv3

The Duplicator plugin in Wordpress prior to 0.5.10 allows remote authenticated users to create and download backup files.

Snapcreek Duplicator

1 EDB exploit

Get Started

1 2 3 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook