Wordpress

Wordpress

381 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
10

CVE-2009-2853

Exploit
  • EPSS 4.71%
  • Veröffentlicht 18.08.2009 21:00:00
  • Zuletzt bearbeitet 16.06.2026 23:10:21

Wordpress before 2.8.3 allows remote attackers to gain privileges via a direct request to (1) admin-footer.php, (2) edit-category-form.php, (3) edit-form-advanced.php, (4) edit-form-comment.php, (5) edit-link-category-form.php, (6) edit-link-form.php...

6.4

CVE-2009-2854

  • EPSS 2.28%
  • Veröffentlicht 18.08.2009 21:00:00
  • Zuletzt bearbeitet 16.06.2026 23:10:21

Wordpress before 2.8.3 does not check capabilities for certain actions, which allows remote attackers to make unauthorized edits or additions via a direct request to (1) edit-comments.php, (2) edit-pages.php, (3) edit.php, (4) edit-category-form.php,...

7.5

CVE-2009-2762

Exploit
  • EPSS 19.64%
  • Veröffentlicht 13.08.2009 16:30:01
  • Zuletzt bearbeitet 16.06.2026 23:10:10

wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for the first user in the database, possibly the administrator, via a key[] array variable in a resetpass (aka rp) action, which bypasses a check that assum...

4.9

CVE-2009-2334

Exploit
  • EPSS 6.26%
  • Veröffentlicht 10.07.2009 21:00:00
  • Zuletzt bearbeitet 16.06.2026 23:09:13

wp-admin/admin.php in WordPress and WordPress MU before 2.8.1 does not require administrative authentication to access the configuration of a plugin, which allows remote attackers to specify a configuration file in the page parameter to obtain sensit...

5

CVE-2009-2335

Exploit
  • EPSS 85%
  • Veröffentlicht 10.07.2009 21:00:00
  • Zuletzt bearbeitet 16.06.2026 23:09:14

WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. NOTE: the vendor reportedly disputes the signific...

5

CVE-2009-2336

Exploit
  • EPSS 5.41%
  • Veröffentlicht 10.07.2009 21:00:00
  • Zuletzt bearbeitet 16.06.2026 23:09:14

The forgotten mail interface in WordPress and WordPress MU before 2.8.1 exhibits different behavior for a password request depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. NOTE: the vendor rep...

5

CVE-2009-2431

  • EPSS 2.87%
  • Veröffentlicht 10.07.2009 21:00:00
  • Zuletzt bearbeitet 16.06.2026 23:09:26

WordPress 2.7.1 places the username of a post's author in an HTML comment, which allows remote attackers to obtain sensitive information by reading the HTML source.

5

CVE-2009-2432

Exploit
  • EPSS 3.08%
  • Veröffentlicht 10.07.2009 21:00:00
  • Zuletzt bearbeitet 16.06.2026 23:09:26

WordPress and WordPress MU before 2.8.1 allow remote attackers to obtain sensitive information via a direct request to wp-settings.php, which reveals the installation path in an error message.

4.3

CVE-2008-6762

Exploit
  • EPSS 2.1%
  • Veröffentlicht 28.04.2009 16:30:03
  • Zuletzt bearbeitet 16.06.2026 23:02:55

Open redirect vulnerability in wp-admin/upgrade.php in WordPress, probably 2.6.x, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the backto parameter.

10

CVE-2008-6767

Exploit
  • EPSS 4.58%
  • Veröffentlicht 28.04.2009 16:30:03
  • Zuletzt bearbeitet 16.06.2026 23:02:56

wp-admin/upgrade.php in WordPress, probably 2.6.x, allows remote attackers to upgrade the application, and possibly cause a denial of service (application outage), via a direct request.