Anant Shrivastava

Name of the Vulnerable Software and Affected Versions: WordPress Portable phpMyAdmin Plugin version 1.4.1 Description: The WordPress Portable phpMyAdmin Plugin has multiple security bypass vulnerabilities. Recommendations: For WordPress Portable phpMyAdmin Plugin version 1.4.1, update to a version that addresses these security bypass vulnerabilities.

Name of the Vulnerable Software and Affected Versions: WordPress Portable phpMyAdmin Plugin (affected versions not specified) Description: The WordPress Portable phpMyAdmin Plugin has an issue that allows authentication bypass. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to a cross-site scripting (XSS) vulnerability. It allows remote attackers to inject arbitrary web script or HTML via the `message` parameter in the comments/videowhisper2/r logout.php file.

The issue is related to a cross-site scripting (XSS) vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML. The injection can be done via the `popup` parameter.

The issue allows remote authenticated administrators to execute arbitrary SQL commands. This is achieved by exploiting the `story` parameter in an edit action to the "wp-admin/admin.php" endpoint.

The issue allows remote attackers to read arbitrary files via a .. (dot dot) in the `snode` parameter. This is a directory traversal vulnerability in the lastfm-proxy.php file.

The issue allows remote authenticated editors to execute arbitrary SQL commands. This is achieved by exploiting the `targetmenu` parameter in an edit action to the "wp-admin/admin.php" endpoint.

The issue allows remote attackers to read arbitrary files. This is achieved via the `file` parameter to the "tom-download-file.php" endpoint.

The issue allows remote authenticated administrators to execute arbitrary SQL commands. This is achieved via the `id` parameter in an edit action in the "allvideogallery videos" page to "wp-admin/admin.php".

The issue allows remote authenticated users with Contributor privileges to execute arbitrary SQL commands. This is achieved by exploiting the `quote` parameter in an edit action in the quartz/quote form.php page to wp-admin/edit.php.

The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `id` parameter in the "wrp-add-new" page to "wp-admin/admin.php".

A directory traversal issue exists, allowing remote attackers to read arbitrary files by using a .. (dot dot) in the `file` parameter.

The issue allows remote authenticated administrators to execute arbitrary SQL commands. This is achieved via the `id` parameter in the "enl-add-new" page to "wp-admin/admin.php".

The issue allows remote attackers to read arbitrary files due to multiple directory traversal vulnerabilities. This is achieved by including a .. (dot dot) in the `fn` parameter to specific API endpoints, such as "charts/treemap.php" or "charts/zoomabletreemap.php".

The issue allows remote attackers to read arbitrary files by providing a full pathname in the `rss` parameter to the "proxy.php" endpoint.

A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the `message` parameter in the `r logout.php` file.

The issue allows remote attackers to inject arbitrary web script or HTML via the `vp`, `vs`, `l`, `vu`, or `vm` parameters in the vcc.js.php file. This can lead to cross-site scripting (XSS) attacks.

The issue is related to a cross-site scripting (XSS) vulnerability. This allows remote attackers to inject arbitrary web script or HTML via the `v` parameter in the wu-ratepost.php file.

The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the `oauth callback` parameter to "html api authorize.php", or the `oauth token temp` or `oauth callback temp` parameters to "html api login.php".

The issue is related to a cross-site scripting (XSS) vulnerability. It allows remote attackers to inject arbitrary web script or HTML via the `post id` parameter in the picasa upload.php file.