Vulnerabilities
Projects
About Us
Contact Us
WhiteSource Vulnerability Database
We found results for “”
CVE-2011-1047
Good to know:
Date: February 21, 2011
Multiple SQL injection vulnerabilities in VastHTML Forum Server (aka ForumPress) plugin 1.6.1 and 1.6.5 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) search_max parameter in a search action to index.php, which is not properly handled by wpf.class.php, (2) id parameter in an editpost action to index.php, which is not properly handled by wpf-post.php, or (3) topic parameter to feed.php.
Language: PHP
Severity Score
Severity Score
Weakness Type (CWE)
SQL Injection
CWE-89Top Fix
Upgrade Version
No fix version available
CVSS v2
| Base Score: |
|
|---|---|
| Access Vector (AV): | NETWORK |
| Access Complexity (AC): | LOW |
| Authentication (AU): | NONE |
| Confidentiality (C): | PARTIAL |
| Integrity (I): | PARTIAL |
| Availability (A): | PARTIAL |
| Additional information: |