Show filters
48 Total Results
Displaying 41-48 of 48
Sort by:
Attacker Value
Unknown
CVE-2008-2146
Disclosure Date: May 12, 2008 (last updated October 04, 2023)
wp-includes/vars.php in Wordpress before 2.2.3 does not properly extract the current path from the PATH_INFO ($PHP_SELF), which allows remote attackers to bypass intended access restrictions for certain pages.
0
Attacker Value
Unknown
CVE-2008-0664
Disclosure Date: February 08, 2008 (last updated October 04, 2023)
The XML-RPC implementation (xmlrpc.php) in WordPress before 2.3.3, when registration is enabled, allows remote attackers to edit posts of other blog users via unknown vectors.
0
Attacker Value
Unknown
CVE-2007-1049
Disclosure Date: February 21, 2007 (last updated October 04, 2023)
Cross-site scripting (XSS) vulnerability in the wp_explain_nonce function in the nonce AYS functionality (wp-includes/functions.php) for WordPress 2.0 before 2.0.9 and 2.1 before 2.1.1 allows remote attackers to inject arbitrary web script or HTML via the file parameter to wp-admin/templates.php, and possibly other vectors involving the action variable.
0
Attacker Value
Unknown
CVE-2007-0233
Disclosure Date: January 13, 2007 (last updated October 04, 2023)
wp-trackback.php in WordPress 2.0.6 and earlier does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary SQL commands via the tb_id parameter. NOTE: it could be argued that this vulnerability is due to a bug in the unset PHP command (CVE-2006-3017) and the proper fix should be in PHP; if so, then this should not be treated as a vulnerability in WordPress.
0
Attacker Value
Unknown
CVE-2006-6808
Disclosure Date: December 28, 2006 (last updated October 04, 2023)
Cross-site scripting (XSS) vulnerability in wp-admin/templates.php in WordPress 2.0.5 allows remote attackers to inject arbitrary web script or HTML via the file parameter. NOTE: some sources have reported this as a vulnerability in the get_file_description function in wp-admin/admin-functions.php.
0
Attacker Value
Unknown
CVE-2006-1796
Disclosure Date: April 17, 2006 (last updated October 04, 2023)
Cross-site scripting (XSS) vulnerability in the paging links functionality in template-functions-links.php in Wordpress 1.5.2, and possibly other versions before 2.0.1, allows remote attackers to inject arbitrary web script or HTML to Internet Explorer users via the request URI ($_SERVER['REQUEST_URI']).
0
Attacker Value
Unknown
CVE-2006-1263
Disclosure Date: March 19, 2006 (last updated February 22, 2025)
Multiple "unannounced" cross-site scripting (XSS) vulnerabilities in WordPress before 2.0.2 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors.
0
Attacker Value
Unknown
CVE-2006-1012
Disclosure Date: March 06, 2006 (last updated February 22, 2025)
SQL injection vulnerability in WordPress 1.5.2, and possibly other versions before 2.0, allows remote attackers to execute arbitrary SQL commands via the User-Agent field in an HTTP header for a comment.
0
