Filtered by vendor Web-dorado
Subscriptions
Total
27 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2015-2196 | 1 Web-dorado | 1 Spider Calendar | 2024-09-17 | N/A |
| SQL injection vulnerability in Spider Event Calendar 1.4.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a spiderbigcalendar_month action to wp-admin/admin-ajax.php. | ||||
| CVE-2014-8584 | 1 Web-dorado | 1 Web-dorado Spider Video Player | 2024-09-16 | N/A |
| Cross-site scripting (XSS) vulnerability in the Web Dorado Spider Video Player (aka WordPress Video Player) plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | ||||
| CVE-2015-1582 | 1 Web-dorado | 1 Spider Facebook | 2024-09-16 | N/A |
| Multiple cross-site scripting (XSS) vulnerabilities in the Spider Facebook plugin before 1.0.11 for WordPress allow (1) remote attackers to inject arbitrary web script or HTML via the appid parameter in a registration task to the default URI or remote administrators to inject arbitrary web script or HTML via the (2) asc_or_desc, (3) order_by, (4) page_number, (5) serch_or_not, or (6) search_events_by_title parameter in (a) the Spider_Facebook_manage page to wp-admin/admin.php or a (b) selectpagesforfacebook or (c) selectpostsforfacebook action to wp-admin/admin-ajax.php. | ||||
| CVE-2023-45632 | 1 Web-dorado | 1 Spidervplayer | 2024-09-12 | 7.1 High |
| Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WebDorado SpiderVPlayer plugin <= 1.5.22 versions. | ||||
| CVE-2023-46090 | 1 Web-dorado | 1 Wdsocialwidgets | 2024-09-09 | 7.1 High |
| Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WebDorado WDSocialWidgets plugin <= 1.0.15 versions. | ||||
| CVE-2023-46619 | 1 Web-dorado | 1 Wdsocialwidgets | 2024-08-29 | 5.4 Medium |
| Cross-Site Request Forgery (CSRF) vulnerability in WebDorado WDSocialWidgets plugin <= 1.0.15 versions. | ||||
| CVE-2015-4350 | 1 Web-dorado | 1 Spider Catalog | 2024-08-06 | N/A |
| Multiple cross-site request forgery (CSRF) vulnerabilities in the Spider Catalog module for Drupal allow remote attackers to hijack the authentication of administrators for requests that delete (1) products, (2) ratings, or (3) categories via unspecified vectors. | ||||
| CVE-2015-4352 | 1 Web-dorado | 1 Web-dorado Spider Video Player | 2024-08-06 | N/A |
| Cross-site request forgery (CSRF) vulnerability in the Spider Video Player module for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete videos via unspecified vectors. | ||||
| CVE-2015-4351 | 1 Web-dorado | 1 Web-dorado Spider Video Player | 2024-08-06 | N/A |
| The Spider Video Player module for Drupal allows remote authenticated users with the "access Spider Video Player administration" permission to delete arbitrary files via a crafted URL. | ||||
| CVE-2015-2798 | 1 Web-dorado | 1 Contact Form Maker | 2024-08-06 | N/A |
| SQL injection vulnerability in Joomla! Component Contact Form Maker 1.0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter. | ||||
| CVE-2015-2562 | 1 Web-dorado | 1 Ecommerce Wd | 2024-08-06 | N/A |
| Multiple SQL injection vulnerabilities in the Web-Dorado ECommerce WD (com_ecommercewd) component 1.2.5 for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) search_category_id, (2) sort_order, or (3) filter_manufacturer_ids in a displayproducts action to index.php. | ||||
| CVE-2017-7719 | 1 Web-dorado | 1 Spider Event Calendar | 2024-08-05 | N/A |
| SQL injection in the Spider Event Calendar (aka spider-event-calendar) plugin before 1.5.52 for WordPress is exploitable with the order_by parameter to calendar_functions.php or widget_Theme_functions.php, related to front_end/frontend_functions.php. | ||||
| CVE-2017-2224 | 1 Web-dorado | 1 Event Calendar Wd | 2024-08-05 | N/A |
| Cross-site scripting vulnerability in Event Calendar WD prior to version 1.0.94 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | ||||
| CVE-2018-16164 | 1 Web-dorado | 1 Event Calendar Wd | 2024-08-05 | N/A |
| Cross-site scripting vulnerability in Event Calendar WD version 1.1.21 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors. | ||||
| CVE-2018-10504 | 1 Web-dorado | 1 Form Maker | 2024-08-05 | N/A |
| The WebDorado "Form Maker by WD" plugin before 1.12.24 for WordPress allows CSV injection. | ||||
| CVE-2018-10301 | 1 Web-dorado | 1 Wd Instagram Feed | 2024-08-05 | N/A |
| Cross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD plugin before 1.3.1 Premium for WordPress allows remote attackers to inject arbitrary web script or HTML by passing payloads in a comment on an Instagram post. | ||||
| CVE-2018-10300 | 1 Web-dorado | 1 Wd Instagram Feed | 2024-08-05 | N/A |
| Cross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD plugin before 1.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML by passing payloads in an Instagram profile's bio. | ||||
| CVE-2018-5981 | 1 Web-dorado | 1 Gallery Wd | 2024-08-05 | N/A |
| SQL Injection exists in the Gallery WD 1.3.6 component for Joomla! via the tag_id parameter or gallery_id parameter. | ||||
| CVE-2018-5991 | 1 Web-dorado | 1 Form Maker | 2024-08-05 | N/A |
| SQL Injection exists in the Form Maker 3.6.12 component for Joomla! via the id, from, or to parameter in a view=stats request, a different vulnerability than CVE-2015-2798. | ||||
| CVE-2019-11591 | 1 Web-dorado | 1 Contact Form | 2024-08-04 | 8.8 High |
| The WebDorado Contact Form plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $_POST['action'] value and the $_GET['action'] value, and the latter is unsanitized. | ||||