Anant Shrivastava

**Nome do software vulnerável e versões afetadas: Plugin WordPress Portable phpMyAdmin versão 1.4.1 Descrição: O plugin WordPress Portable phpMyAdmin apresenta várias vulnerabilidades que permitem contornar as medidas de segurança. Recomendações: Para o plugin WordPress Portable phpMyAdmin versão 1.4.1, atualize para uma versão que corrija essas vulnerabilidades de contorno de segurança.

**Nome do software vulnerável e versões afetadas: Plugin WordPress Portable phpMyAdmin (versões afetadas não especificadas) Descrição: O plugin WordPress Portable phpMyAdmin apresenta uma falha que permite a contornar a autenticação. Recomendações: No momento, não há informações sobre uma versão mais recente que contenha uma correção para essa vulnerabilidade.

The issue is related to a cross-site scripting (XSS) vulnerability. It allows remote attackers to inject arbitrary web script or HTML via the `message` parameter in the comments/videowhisper2/r logout.php file.

The issue is related to a cross-site scripting (XSS) vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML. The injection can be done via the `popup` parameter.

The issue allows remote authenticated administrators to execute arbitrary SQL commands. This is achieved by exploiting the `story` parameter in an edit action to the "wp-admin/admin.php" endpoint.

The issue allows remote attackers to read arbitrary files via a .. (dot dot) in the `snode` parameter. This is a directory traversal vulnerability in the lastfm-proxy.php file.

The issue allows remote authenticated editors to execute arbitrary SQL commands. This is achieved by exploiting the `targetmenu` parameter in an edit action to the "wp-admin/admin.php" endpoint.

The issue allows remote attackers to read arbitrary files. This is achieved via the `file` parameter to the "tom-download-file.php" endpoint.

The issue allows remote authenticated administrators to execute arbitrary SQL commands. This is achieved via the `id` parameter in an edit action in the "allvideogallery videos" page to "wp-admin/admin.php".

The issue allows remote authenticated users with Contributor privileges to execute arbitrary SQL commands. This is achieved by exploiting the `quote` parameter in an edit action in the quartz/quote form.php page to wp-admin/edit.php.

The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `id` parameter in the "wrp-add-new" page to "wp-admin/admin.php".

A directory traversal issue exists, allowing remote attackers to read arbitrary files by using a .. (dot dot) in the `file` parameter.

The issue allows remote authenticated administrators to execute arbitrary SQL commands. This is achieved via the `id` parameter in the "enl-add-new" page to "wp-admin/admin.php".

The issue allows remote attackers to read arbitrary files due to multiple directory traversal vulnerabilities. This is achieved by including a .. (dot dot) in the `fn` parameter to specific API endpoints, such as "charts/treemap.php" or "charts/zoomabletreemap.php".

The issue allows remote attackers to read arbitrary files by providing a full pathname in the `rss` parameter to the "proxy.php" endpoint.

A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the `message` parameter in the `r logout.php` file.

The issue allows remote attackers to inject arbitrary web script or HTML via the `vp`, `vs`, `l`, `vu`, or `vm` parameters in the vcc.js.php file. This can lead to cross-site scripting (XSS) attacks.

The issue is related to a cross-site scripting (XSS) vulnerability. This allows remote attackers to inject arbitrary web script or HTML via the `v` parameter in the wu-ratepost.php file.

The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the `oauth callback` parameter to "html api authorize.php", or the `oauth token temp` or `oauth callback temp` parameters to "html api login.php".

The issue is related to a cross-site scripting (XSS) vulnerability. It allows remote attackers to inject arbitrary web script or HTML via the `post id` parameter in the picasa upload.php file.