WordPress — свободно распространяемая система управления содержимым сайта с открытым исходным кодом.
Релизный цикл, информация об уязвимостях
График релизов
Количество 1 928
CVE-2012-2401
Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPres ...
CVE-2012-2404
wp-comments-post.php in WordPress before 3.3.2 supports offsite redire ...
CVE-2012-2399
Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFupload ...
CVE-2011-5082
Cross-site scripting (XSS) vulnerability in the s2Member Pro plugin before 111220 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s2member_pro_authnet_checkout[coupon] parameter (aka Coupon Code field).
CVE-2012-1785
kg_callffmpeg.php in the Video Embed & Thumbnail Generator plugin before 2.0 for WordPress allows remote attackers to execute arbitrary commands via unspecified vectors.
CVE-2012-1786
The Media Upload form in the Video Embed & Thumbnail Generator plugin before 2.0 for WordPress allows remote attackers to obtain the installation path via unknown vectors.
CVE-2012-1205
PHP remote file inclusion vulnerability in relocate-upload.php in Relocate Upload plugin before 0.20 for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the abspath parameter.
CVE-2012-1068
Cross-site scripting (XSS) vulnerability in the rc_ajax function in core.php in the WP-RecentComments plugin before 2.0.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter, related to AJAX paging.
CVE-2012-1067
SQL injection vulnerability in the WP-RecentComments plugin 2.0.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter in an rc-content action to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVE-2012-1011
actions.php in the AllWebMenus plugin 1.1.8 for WordPress allows remote attackers to bypass intended access restrictions to upload and execute arbitrary PHP code by setting the HTTP_REFERER to a certain value, then uploading a ZIP file containing a PHP file, then accessing it via a direct request to the file in an unspecified directory.
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано 1 | |
|---|---|---|---|---|
| CVE-2012-2401 Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPres ... | CVSS2: 5 | 4% Низкий | больше 14 лет назад |
| CVE-2012-2404 wp-comments-post.php in WordPress before 3.3.2 supports offsite redire ... | CVSS2: 4.3 | 3% Низкий | больше 14 лет назад |
| CVE-2012-2399 Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFupload ... | CVSS2: 10 | 9% Низкий | больше 14 лет назад |
 | CVE-2011-5082 Cross-site scripting (XSS) vulnerability in the s2Member Pro plugin before 111220 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s2member_pro_authnet_checkout[coupon] parameter (aka Coupon Code field). | CVSS2: 4.3 | 2% Низкий | больше 14 лет назад |
| CVE-2012-1785 kg_callffmpeg.php in the Video Embed & Thumbnail Generator plugin before 2.0 for WordPress allows remote attackers to execute arbitrary commands via unspecified vectors. | CVSS2: 7.5 | 3% Низкий | больше 14 лет назад |
| CVE-2012-1786 The Media Upload form in the Video Embed & Thumbnail Generator plugin before 2.0 for WordPress allows remote attackers to obtain the installation path via unknown vectors. | CVSS2: 5 | 2% Низкий | больше 14 лет назад |
| CVE-2012-1205 PHP remote file inclusion vulnerability in relocate-upload.php in Relocate Upload plugin before 0.20 for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the abspath parameter. | CVSS2: 7.5 | 25% Средний | больше 14 лет назад |
| CVE-2012-1068 Cross-site scripting (XSS) vulnerability in the rc_ajax function in core.php in the WP-RecentComments plugin before 2.0.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter, related to AJAX paging. | CVSS2: 4.3 | 2% Низкий | больше 14 лет назад |
| CVE-2012-1067 SQL injection vulnerability in the WP-RecentComments plugin 2.0.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter in an rc-content action to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. | CVSS2: 7.5 | 2% Низкий | больше 14 лет назад |
| CVE-2012-1011 actions.php in the AllWebMenus plugin 1.1.8 for WordPress allows remote attackers to bypass intended access restrictions to upload and execute arbitrary PHP code by setting the HTTP_REFERER to a certain value, then uploading a ZIP file containing a PHP file, then accessing it via a direct request to the file in an unspecified directory. | CVSS2: 7.5 | 9% Низкий | почти 15 лет назад |
Уязвимостей на страницу