Show filters
22 Total Results
Displaying 11-20 of 22
Sort by:
Attacker Value
Unknown
CVE-2020-28642
Disclosure Date: November 16, 2020 (last updated February 22, 2025)
In InfiniteWP Admin Panel before 3.1.12.3, resetPasswordSendMail generates a weak password-reset code, which makes it easier for remote attackers to conduct admin Account Takeover attacks.
0
Attacker Value
Unknown
CVE-2020-8772
Disclosure Date: February 06, 2020 (last updated February 21, 2025)
The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwp_mmb_set_request in init.php. Any attacker who knows the username of an administrator can log in.
0
Attacker Value
Unknown
CVE-2019-17356
Disclosure Date: October 15, 2019 (last updated November 27, 2024)
The Infinite Design application 3.4.12 for Android sends a username and password via TCP without any encryption during login, as demonstrated by sniffing of a public Wi-Fi network.
0
Attacker Value
Unknown
CVE-2015-1568
Disclosure Date: February 09, 2015 (last updated October 05, 2023)
Cross-site request forgery (CSRF) vulnerability in the GD Infinite Scroll module before 7.x-1.4 for Drupal allows remote attackers to hijack the authentication of users with the "edit gd infinite scroll settings" permission for requests that delete settings via unspecified vectors.
0
Attacker Value
Unknown
CVE-2015-1567
Disclosure Date: February 09, 2015 (last updated October 05, 2023)
Cross-site scripting (XSS) vulnerability in the admin page in the GD Infinite Scroll module before 7.x-1.4 for Drupal allows remote authenticated users with the "edit gd infinite scroll settings" permission to inject arbitrary web script or HTML via unspecified vectors.
0
Attacker Value
Unknown
CVE-2014-9520
Disclosure Date: January 05, 2015 (last updated October 05, 2023)
SQL injection vulnerability in execute.php in InfiniteWP Admin Panel before 2.4.4 allows remote attackers to execute arbitrary SQL commands via the historyID parameter.
0
Attacker Value
Unknown
CVE-2014-9519
Disclosure Date: January 05, 2015 (last updated October 05, 2023)
SQL injection vulnerability in login.php in InfiniteWP Admin Panel before 2.4.3 allows remote attackers to execute arbitrary SQL commands via the email parameter.
0
Attacker Value
Unknown
CVE-2014-9521
Disclosure Date: January 05, 2015 (last updated October 05, 2023)
Unrestricted file upload vulnerability in uploadScript.php in InfiniteWP Admin Panel before 2.4.4, when the allWPFiles query parameter is set, allows remote attackers to execute arbitrary code by uploading a file with a double extension, then accessing it via a direct request to the file in the uploads directory, as demonstrated by the .php.swp filename.
0
Attacker Value
Unknown
CVE-2007-3943
Disclosure Date: July 21, 2007 (last updated October 04, 2023)
SQL injection vulnerability in Infinite Responder before 1.48 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. NOTE: some of these details are obtained from third party information.
0
Attacker Value
Unknown
CVE-2005-0324
Disclosure Date: May 02, 2005 (last updated February 22, 2025)
Infinite Mobile Delivery Webmail 2.6 allows remote attackers to gain sensitive information via an HTTP request that contains invalid characters for a Windows foldername, which reveals the path in an error message.
0
