Manuel Garcia Cardenas

A problematic issue has been found in the Easy Table Plugin, affecting an unknown part of the file /wordpress/wp-admin/options-general.php. The manipulation with the input "><script>alert(1)</script> leads to basic cross site scripting. It is possible to initiate the attack remotely.

A critical vulnerability has been found in the Kama Click Counter Plugin. This issue affects an unknown part of the file wp-admin/admin.php. The manipulation of the `order by/order` argument with the input `ASC%2c(select*from(select(sleep(2)))a)` leads to SQL injection (Blind). It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

The issue allows for Persistent XSS via a Usergroup name under the Security configuration. This can be exploited to execute malicious scripts on the affected system.

The issue allows for XSS via the `m1 name` parameter in the "Add Article" section under Content -> Content Manager -> News.

The issue allows an attacker to upload a malicious file to any folder on the site via a cpi directory traversal in the Pixidou Image Editor.

A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the `cat description` parameter in an "updatecat" action to "admin/categories.php".

The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the QUERY STRING to "wb/admin/admintools/tool.php" or the `section id` parameter to several files in the wb/modules/ directory, including "edit module files.php", "news/add post.php", "news/modify group.php", "news/modify post.php", and "news/modify settings.php".

A SQL injection issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `page id` parameter in the "admin/pages/modify.php" endpoint.

The issue is related to a cross-site scripting (XSS) vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the `photographer id` or ` crumb` parameter in the php/edit photos.php file.

The issue allows remote authenticated users to execute arbitrary SQL commands. This can be achieved via the ` action` parameter to `group.php` or `user.php`, or the `location id` parameter to `photos.php` in `php/`.

The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the `author name` or `content` parameter to "index.php".

The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the `selgroups` parameter in the `/htdocs/modules/system/admin.php` API endpoint.