Vulnerability database

407 results · page 9 of 9

• Sep 27, 2017Mojoomla School Management System for WordPress allows SQL Injection via the id parameter.CVE-2017-14843 · WordPress plugins & themes · reported by MITREHigh 8.8

  Mojoomla School Management System for WordPress allows SQL Injection via the id parameter.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordexploit-db.comexploit-db.com

• Sep 27, 2017SQL Injection exists in /includes/event-management/index.php in the event-espresso-free (aka Event Espresso Lite) plugin v3.1.37.12.L for WordPress via the recuCVE-2017-14760 · WordPress plugins & themes · reported by MITRECritical 9.8

  SQL Injection exists in /includes/event-management/index.php in the event-espresso-free (aka Event Espresso Lite) plugin v3.1.37.12.L for WordPress via the recurrence_id parameter to /wp-admin/admin.php.

  Product

  event-espresso-free (aka Event Espresso Lite)

  Affected

  up to 3.1.37.12.l

  What to do

  Affects up to 3.1.37.12.l. Update event-espresso-free (aka Event Espresso Lite) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordsstrunk.comsstrunk.com

• Jan 8, 2014Cross-site scripting (XSS) vulnerability in views/video-management/preview_video.php in the S3 Video plugin before 0.983 for WordPress allows remote attackers tCVE-2013-7279 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in views/video-management/preview_video.php in the S3 Video plugin before 0.983 for WordPress allows remote attackers to inject arbitrary web script or HTML via the base parameter.

  Product

  Cross-site scripting (XSS) vulnerability in views/video-management/preview_video.php in the S3 Video

  Fixed in

  0.983

  What to do

  Update Cross-site scripting (XSS) vulnerability in views/video-management/preview_video.php in the S3 Video to 0.983 or newer.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgsecunia.com

• Jul 20, 2007index.php in SpoonLabs Vivvo Article Management CMS: SQL injectionCVE-2007-3939 · WordPress plugins & themes · reported by MITREMedium 6.8

  SQL injection vulnerability in index.php in SpoonLabs Vivvo Article Management CMS (aka phpWordPress) CMS 3.4 and earlier allows remote attackers to execute arbitrary SQL commands via the category parameter.

  Product

  index.php in SpoonLabs Vivvo Article Management CMS

  Affected

  up to 3.4

  What to do

  Affects up to 3.4. Update index.php in SpoonLabs Vivvo Article Management CMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordosvdb.orgsecurityfocus.com

• Jan 30, 2007rss/show_webfeed.php in SpoonLabs Vivvo Article Management CMS: SQL injectionCVE-2007-0574 · WordPress plugins & themes · reported by MITREHigh 7.5

  SQL injection vulnerability in rss/show_webfeed.php in SpoonLabs Vivvo Article Management CMS (aka phpWordPress) 3.40 allows remote attackers to execute arbitrary SQL commands via the wcHeadlines parameter, a different vector than CVE-2006-4715. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.

  Product

  rss/show_webfeed.php in SpoonLabs Vivvo Article Management CMS

  What to do

  Update rss/show_webfeed.php in SpoonLabs Vivvo Article Management CMS to the newest version.

  Full record and what to do →NVD recordosvdb.orgsecurityfocus.com

• Sep 12, 2006pdf_version.php in SpoonLabs Vivvo Article Management CMS: SQL injectionCVE-2006-4715 · WordPress plugins & themes · reported by MITREHigh 7.5

  SQL injection vulnerability in pdf_version.php in SpoonLabs Vivvo Article Management CMS (aka phpWordPress) 3.2 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

  Product

  pdf_version.php in SpoonLabs Vivvo Article Management CMS

  Affected

  up to 3.2

  What to do

  Affects up to 3.2. Update pdf_version.php in SpoonLabs Vivvo Article Management CMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordsecunia.comsecuritydot.net

• Sep 12, 2006index.php in SpoonLabs Vivvo Article Management CMS: PHP remote file inclusionCVE-2006-4714 · WordPress plugins & themes · reported by MITREMedium 5.1

  PHP remote file inclusion vulnerability in index.php in SpoonLabs Vivvo Article Management CMS (aka phpWordPress) 3.2 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the classified_path parameter.

  Product

  index.php in SpoonLabs Vivvo Article Management CMS

  Affected

  up to 3.2

  What to do

  Affects up to 3.2. Update index.php in SpoonLabs Vivvo Article Management CMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordsecunia.comsecuritydot.net

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.