Wordpress

Wordpress

360 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
3.5

CVE-2009-3891

  • EPSS 1.04%
  • Published 17.11.2009 18:30:00
  • Last modified 09.04.2025 00:30:58

Cross-site scripting (XSS) vulnerability in wp-admin/press-this.php in WordPress before 2.8.6 allows remote authenticated users to inject arbitrary web script or HTML via the s parameter (aka the selection variable).

4.3

CVE-2009-3622

Exploit
  • EPSS 8.32%
  • Published 23.10.2009 18:30:00
  • Last modified 09.04.2025 00:30:58

Algorithmic complexity vulnerability in wp-trackback.php in WordPress before 2.8.5 allows remote attackers to cause a denial of service (CPU consumption and server hang) via a long title parameter in conjunction with a charset parameter composed of m...

4.3

CVE-2009-2851

  • EPSS 2.99%
  • Published 18.08.2009 21:00:00
  • Last modified 09.04.2025 00:30:58

Cross-site scripting (XSS) vulnerability in the administrator interface in WordPress before 2.8.2 allows remote attackers to inject arbitrary web script or HTML via a comment author URL.

10

CVE-2009-2853

Exploit
  • EPSS 1.2%
  • Published 18.08.2009 21:00:00
  • Last modified 09.04.2025 00:30:58

Wordpress before 2.8.3 allows remote attackers to gain privileges via a direct request to (1) admin-footer.php, (2) edit-category-form.php, (3) edit-form-advanced.php, (4) edit-form-comment.php, (5) edit-link-category-form.php, (6) edit-link-form.php...

6.4

CVE-2009-2854

  • EPSS 1.42%
  • Published 18.08.2009 21:00:00
  • Last modified 09.04.2025 00:30:58

Wordpress before 2.8.3 does not check capabilities for certain actions, which allows remote attackers to make unauthorized edits or additions via a direct request to (1) edit-comments.php, (2) edit-pages.php, (3) edit.php, (4) edit-category-form.php,...

7.5

CVE-2009-2762

Exploit
  • EPSS 74.13%
  • Published 13.08.2009 16:30:01
  • Last modified 09.04.2025 00:30:58

wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for the first user in the database, possibly the administrator, via a key[] array variable in a resetpass (aka rp) action, which bypasses a check that assum...

4.9

CVE-2009-2334

Exploit
  • EPSS 13.97%
  • Published 10.07.2009 21:00:00
  • Last modified 09.04.2025 00:30:58

wp-admin/admin.php in WordPress and WordPress MU before 2.8.1 does not require administrative authentication to access the configuration of a plugin, which allows remote attackers to specify a configuration file in the page parameter to obtain sensit...

5

CVE-2009-2335

Exploit
  • EPSS 85.34%
  • Published 10.07.2009 21:00:00
  • Last modified 09.04.2025 00:30:58

WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. NOTE: the vendor reportedly disputes the signific...

5

CVE-2009-2336

Exploit
  • EPSS 2.3%
  • Published 10.07.2009 21:00:00
  • Last modified 09.04.2025 00:30:58

The forgotten mail interface in WordPress and WordPress MU before 2.8.1 exhibits different behavior for a password request depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. NOTE: the vendor rep...

5

CVE-2009-2431

  • EPSS 1.19%
  • Published 10.07.2009 21:00:00
  • Last modified 09.04.2025 00:30:58

WordPress 2.7.1 places the username of a post's author in an HTML comment, which allows remote attackers to obtain sensitive information by reading the HTML source.