Htbridge

Name of the Vulnerable Software and Affected Versions: Huge-IT Slider (slider-image) plugin versions prior to 2.7.0 Description: The issue allows remote administrators to execute arbitrary SQL commands. This can be achieved via the `removeslide` parameter in a `popup posts` or `edit cat` action in the `sliders huge it slider` page to `wp-admin/admin.php`. Recommendations: For versions prior to 2.7.0, update to version 2.7.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the `removeslide` parameter in the affected API endpoint until the issue is resolved.

The issue allows remote administrators to execute arbitrary SQL commands. This can be achieved via the `letter` parameter in a user action or the `edit category` parameter to "index.php".

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the `back` parameter to "index.php".

A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the `procname` parameter to "wp-admin/tools.php".

The issue allows remote attackers to inject arbitrary web script or HTML via the `key` parameter in a delete action to "wp-admin/tools.php". This is a cross-site scripting (XSS) issue.

The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the "c" parameter to the API endpoint "index.php".

A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the `lang` parameter in a web action.

The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting SQL injection vulnerabilities via the `i` parameter in an edit action to API endpoints such as "contentAE.asp" or "templatesAE.asp".

A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the `sitetitle` parameter in the autocms.php file.