wordpress wordpress 3.5.2 vulnerabilities and exploits

(subscribe to this query)

4.3

CVSSv2

wp-includes/class-phpass.php in WordPress 3.5.1, when a password-protected post exists, allows remote malicious users to cause a denial of service (CPU consumption) via a crafted value of a certain wp-postpass cookie.

Wordpress Wordpress 3.5.1

7.5

CVSSv2

There is an object injection vulnerability in swfupload plugin for wordpress.

Swfupload Project Swfupload 3.5.2

7.5

CVSSv2

SQL injection vulnerability in leaguemanager.php in the LeagueManager plugin prior to 3.8.1 for WordPress allows remote malicious users to execute arbitrary SQL commands via the league_id parameter in the leaguemanager-export page to wp-admin/admin.php.

1 EDB exploit1 Github repository

NA

The Social Warfare plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.5.2 via the 'swp_url' parameter. This allows malicious users to execute code on the server.

Warfareplugins Social Warfare

7.5

CVSSv2

The Astra Pro Addon WordPress plugin prior to 3.5.2 did not properly sanitise or escape some of the POST parameters from the astra_pagination_infinite and astra_shop_pagination_infinite AJAX action (available to both unauthenticated and authenticated user) before using them in SQ...

Brainstormforce Astra

1 Github repository

NA

The Login Screen Manager WordPress plugin up to and including 3.5.2 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for e...

Login Screen Manager Project Login Screen Manager

4.3

CVSSv2

The OpenBook Book Data WordPress plugin up to and including 3.5.2 does not have CSRF check in place when updating its settings, which could allow malicious users to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of san...

Openbook Book Data Project Openbook Book Data

4

CVSSv2

Deepwoods Software WebLibrarian 3.5.2 and previous versions is affected by: SQL Injection. The impact is: Exposing the entire database. The component is: Function "AllBarCodes" (defined at database_code.php line 1018) is vulnerable to a boolean-based blind sql injection...

Deepsoft Weblibrarian

NA

The Easy Property Listings plugin for WordPress is vulnerable to time-based SQL Injection via the ‘property_status’ shortcode attribute in all versions up to, and including, 3.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient prepa...

Get Started

« PREV 1 2

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook