45.60.39.111

Regular View Raw Data
Last Seen: 2024-05-14
Tags:
cdn

GeneralInformation

Hostnames webuploadtest.hays.com
hayslearning.co.uk
www.hayslearning.co.uk
hayslearning.com
br.hayslearning.com
www.br.hayslearning.com
ca.hayslearning.com
www.ca.hayslearning.com
cl.hayslearning.com
www.cl.hayslearning.com
co.hayslearning.com
www.co.hayslearning.com
ftp.hayslearning.com
imap.hayslearning.com
mail.hayslearning.com
mx.hayslearning.com
www.mx.hayslearning.com
qc.hayslearning.com
www.qc.hayslearning.com
smtp.hayslearning.com
us.hayslearning.com
www.us.hayslearning.com
www.hayslearning.com
hayslearning.eu
es.hayslearning.eu
www.es.hayslearning.eu
fr.hayslearning.eu
www.fr.hayslearning.eu
www.hayslearning.eu
hayslearning.ie
www.hayslearning.ie
imperva.com
Domains hays.com hayslearning.co.uk hayslearning.com hayslearning.eu hayslearning.ie imperva.com 
Country United States
City Redwood City
Organization Incapsula Inc
ISP Incapsula Inc
ASN AS19551

Vulnerabilities

Note: the device may not be impacted by all of these issues. The vulnerabilities are implied based on the software and version.

CVE-2023-5561 WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack
CVE-2023-39999 Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.13, from 6.0 through 6.0.5, from 5.9 through 5.9.7, from 5.8 through 5.8.7, from 5.7 through 5.7.9, from 5.6 through 5.6.11, from 5.5 through 5.5.12, from 5.4 through 5.4.13, from 5.3 through 5.3.15, from 5.2 through 5.2.18, from 5.1 through 5.1.16, from 5.0 through 5.0.19, from 4.9 through 4.9.23, from 4.8 through 4.8.22, from 4.7 through 4.7.26, from 4.6 through 4.6.26, from 4.5 through 4.5.29, from 4.4 through 4.4.30, from 4.3 through 4.3.31, from 4.2 through 4.2.35, from 4.1 through 4.1.38.
CVE-2023-38000 Auth. Stored (contributor+) Cross-Site Scripting (XSS) vulnerability in WordPress core 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.1.3, from 6.0 through 6.0.5, from 5.9 through 5.9.7 and Gutenberg plugin <= 16.8.0 versions.
CVE-2023-2745 WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers to access and load arbitrary translation files. In cases where an attacker is able to upload a crafted translation file onto the site, such as via an upload form, this could be also used to perform a Cross-Site Scripting attack.
CVE-2023-22622 WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes "the scenario where a site may not receive enough visits to execute scheduled tasks in a timely manner," but neither the installation guide nor the security guide mentions this default behavior, or alerts the user about security risks on installations with very few visits.
CVE-2022-3590 WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden.
CVE-2013-5918 4.3Cross-site scripting (XSS) vulnerability in platinum_seo_pack.php in the Platinum SEO plugin before 1.3.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVE-2012-2920 4.3Cross-site scripting (XSS) vulnerability in the userphoto_options_page function in user-photo.php in the User Photo plugin before 0.9.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to wp-admin/options-general.php. NOTE: some of these details are obtained from third party information.
CVE-2012-2917 4.3Cross-site scripting (XSS) vulnerability in the Share and Follow plugin 1.80.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the CDN API Key (cnd-key) in a share-and-follow-menu page to wp-admin/admin.php.
CVE-2012-2916 4.3Cross-site scripting (XSS) vulnerability in sabre_class_admin.php in the SABRE plugin before 2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the active_option parameter to wp-admin/tools.php.
CVE-2012-2913 4.3Multiple cross-site scripting (XSS) vulnerabilities in the Leaflet plugin 0.0.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the id parameter to (1) leaflet_layer.php or (2) leaflet_marker.php, as reachable through wp-admin/admin.php.
CVE-2012-2912 4.3Multiple cross-site scripting (XSS) vulnerabilities in the LeagueManager plugin 3.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) group parameter in the show-league page or (2) season parameter in the team page to wp-admin/admin.php.
CVE-2012-2759 4.3Cross-site scripting (XSS) vulnerability in login-with-ajax.php in the Login With Ajax (aka login-with-ajax) plugin before 3.0.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the callback parameter in a lostpassword action to wp-login.php.
CVE-2012-1786 5.0The Media Upload form in the Video Embed & Thumbnail Generator plugin before 2.0 for WordPress allows remote attackers to obtain the installation path via unknown vectors.
CVE-2012-1785 7.5kg_callffmpeg.php in the Video Embed & Thumbnail Generator plugin before 2.0 for WordPress allows remote attackers to execute arbitrary commands via unspecified vectors.
CVE-2012-1205 7.5PHP remote file inclusion vulnerability in relocate-upload.php in Relocate Upload plugin before 0.20 for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the abspath parameter.
CVE-2012-1068 4.3Cross-site scripting (XSS) vulnerability in the rc_ajax function in core.php in the WP-RecentComments plugin before 2.0.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter, related to AJAX paging.
CVE-2012-1067 7.5SQL injection vulnerability in the WP-RecentComments plugin 2.0.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter in an rc-content action to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVE-2012-1011 7.5actions.php in the AllWebMenus plugin 1.1.8 for WordPress allows remote attackers to bypass intended access restrictions to upload and execute arbitrary PHP code by setting the HTTP_REFERER to a certain value, then uploading a ZIP file containing a PHP file, then accessing it via a direct request to the file in an unspecified directory.
CVE-2012-1010 7.5Unrestricted file upload vulnerability in actions.php in the AllWebMenus plugin before 1.1.8 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a ZIP file containing a PHP file, then accessing it via a direct request to the file in an unspecified directory.
CVE-2012-0934 7.5PHP remote file inclusion vulnerability in ajax/savetag.php in the Theme Tuner plugin for WordPress before 0.8 allows remote attackers to execute arbitrary PHP code via a URL in the tt-abspath parameter.
CVE-2012-0898 5.0Directory traversal vulnerability in meb_download.php in the myEASYbackup plugin 1.0.8.1 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the dwn_file parameter.
CVE-2012-0896 5.0Absolute path traversal vulnerability in download.php in the Count Per Day module before 3.1.1 for WordPress allows remote attackers to read arbitrary files via the f parameter.
CVE-2012-0895 4.3Cross-site scripting (XSS) vulnerability in map/map.php in the Count Per Day module before 3.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the map parameter.
CVE-2011-5082 4.3Cross-site scripting (XSS) vulnerability in the s2Member Pro plugin before 111220 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s2member_pro_authnet_checkout[coupon] parameter (aka Coupon Code field).
CVE-2011-5051 7.5Multiple unrestricted file upload vulnerabilities in the WP Symposium plugin before 11.12.24 for WordPress allow remote attackers to execute arbitrary code by uploading a file with an executable extension using (1) uploadify/upload_admin_avatar.php or (2) uploadify/upload_profile_avatar.php, then accessing it via a direct request to the file in an unspecified directory inside the webroot.
CVE-2011-4803 7.5SQL injection vulnerability in wptouch/ajax.php in the WPTouch plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2011-4673 7.5SQL injection vulnerability in modules/sharedaddy.php in the Jetpack plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2011-4671 7.5SQL injection vulnerability in adrotate/adrotate-out.php in the AdRotate plugin 3.6.6, and other versions before 3.6.8, for WordPress allows remote attackers to execute arbitrary SQL commands via the track parameter (aka redirect URL).
CVE-2011-4669 7.5SQL injection vulnerability in wp-users.php in WordPress Users plugin 1.3 and possibly earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the uid parameter to index.php.
CVE-2011-4646 6.0SQL injection vulnerability in wp-postratings.php in the WP-PostRatings plugin 1.50, 1.61, and probably other versions before 1.62 for WordPress allows remote authenticated users with the Author role to execute arbitrary SQL commands via the id attribute of the ratings shortcode when creating a post. NOTE: some of these details are obtained from third party information.
CVE-2011-4568 4.3Cross-site scripting (XSS) vulnerability in view/frontend-head.php in the Flowplayer plugin before 1.2.12 for WordPress allows remote attackers to inject arbitrary web script or HTML via the URI.
CVE-2011-4562 4.3Multiple cross-site scripting (XSS) vulnerabilities in (1) view/admin/log_item.php and (2) view/admin/log_item_details.php in the Redirection plugin 2.2.9 for WordPress allow remote attackers to inject arbitrary web script or HTML via the Referer HTTP header in a request to a post that does not exist.
CVE-2011-3981 7.5PHP remote file inclusion vulnerability in actions.php in the Allwebmenus plugin 1.1.3 for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the abspath parameter.
CVE-2011-3865 4.3Cross-site scripting (XSS) vulnerability in the Black-LetterHead theme before 1.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php.
CVE-2011-3864 4.3Cross-site scripting (XSS) vulnerability in the The Erudite theme before 2.7.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cpage parameter.
CVE-2011-3863 4.3Cross-site scripting (XSS) vulnerability in the RedLine theme before 1.66 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVE-2011-3862 4.3Cross-site scripting (XSS) vulnerability in the Morning Coffee theme before 3.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php.
CVE-2011-3861 4.3Cross-site scripting (XSS) vulnerability in the Web Minimalist 200901 theme before 1.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php.
CVE-2011-3860 4.3Cross-site scripting (XSS) vulnerability in the Cover WP theme before 1.6.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVE-2011-3859 4.3Cross-site scripting (XSS) vulnerability in the Trending theme before 0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cpage parameter.
CVE-2011-3858 4.3Cross-site scripting (XSS) vulnerability in the Pixiv Custom theme before 2.1.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVE-2011-3857 4.3Cross-site scripting (XSS) vulnerability in the Antisnews theme before 1.10 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVE-2011-3856 4.3Cross-site scripting (XSS) vulnerability in the Elegant Grunge theme before 1.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVE-2011-3855 4.3Cross-site scripting (XSS) vulnerability in the F8 Lite theme before 4.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVE-2011-3854 4.3Cross-site scripting (XSS) vulnerability in the ZenLite theme before 4.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVE-2011-3853 4.3Cross-site scripting (XSS) vulnerability in the Hybrid theme before 0.10 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cpage parameter.
CVE-2011-3852 4.3Cross-site scripting (XSS) vulnerability in the EvoLve theme before 1.2.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVE-2011-3851 4.3Cross-site scripting (XSS) vulnerability in the News theme before 0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cpage parameter.
CVE-2011-3850 4.3Cross-site scripting (XSS) vulnerability in the Atahualpa theme before 3.6.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVE-2011-1669 5.0Directory traversal vulnerability in wp-download.php in the WP Custom Pages module 0.5.0.1 for WordPress allows remote attackers to read arbitrary files via ..%2F (encoded dot dot) sequences in the url parameter.
CVE-2011-1047 7.5Multiple SQL injection vulnerabilities in VastHTML Forum Server (aka ForumPress) plugin 1.6.1 and 1.6.5 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) search_max parameter in a search action to index.php, which is not properly handled by wpf.class.php, (2) id parameter in an editpost action to index.php, which is not properly handled by wpf-post.php, or (3) topic parameter to feed.php.
CVE-2011-0760 4.3Multiple cross-site request forgery (CSRF) vulnerabilities in the configuration screen in wp-relatedposts.php in the WP Related Posts plugin 1.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that insert cross-site scripting (XSS) sequences via the (1) wp_relatedposts_title, (2) wp_relatedposts_num, or (3) wp_relatedposts_type parameter.
CVE-2011-0759 6.8Multiple cross-site request forgery (CSRF) vulnerabilities in the configuration page in the Recaptcha (aka WP-reCAPTCHA) plugin 2.9.8.2 for WordPress allow remote attackers to hijack the authentication of administrators for requests that disable the CAPTCHA requirement or insert cross-site scripting (XSS) sequences via the (1) recaptcha_opt_pubkey, (2) recaptcha_opt_privkey, (3) re_tabindex, (4) error_blank, (5) error_incorrect, (6) mailhide_pub, (7) mailhide_priv, (8) mh_replace_link, or (9) mh_replace_title parameter.
CVE-2011-0740 4.3Cross-site scripting (XSS) vulnerability in magpie/scripts/magpie_slashbox.php in RSS Feed Reader 0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the rss_url parameter.
CVE-2011-0641 4.3Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/admin.php in the StatPressCN plugin 1.9.0 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) what1, (2) what2, (3) what3, (4) what4, and (5) what5 parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVE-2010-4875 4.3Cross-site scripting (XSS) vulnerability in vodpod-video-gallery/vodpod_gallery_thumbs.php in the Vodpod Video Gallery Plugin 3.1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the gid parameter.
CVE-2010-4839 7.5SQL injection vulnerability in the Event Registration plugin 5.32 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the event_id parameter in a register action.
CVE-2010-4825 4.3Cross-site scripting (XSS) vulnerability in magpie_debug.php in the Twitter Feed plugin (wp-twitter-feed) 0.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the url parameter.
CVE-2010-4779 4.3Cross-site scripting (XSS) vulnerability in lib/includes/auth.inc.php in the WPtouch plugin 1.9.19.4 and 1.9.20 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wptouch_settings parameter to include/adsense-new.php. NOTE: some of these details are obtained from third party information.
CVE-2010-4747 4.3Cross-site scripting (XSS) vulnerability in wordpress-processing-embed/data/popup.php in the Processing Embed plugin 0.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the pluginurl parameter.
CVE-2010-4637 4.3Cross-site scripting (XSS) vulnerability in feedlist/handler_image.php in the FeedList plugin 2.61.01 for WordPress allows remote attackers to inject arbitrary web script or HTML via the i parameter.
CVE-2010-4630 4.3Cross-site scripting (XSS) vulnerability in pages/admin/surveys/create.php in the WP Survey And Quiz Tool plugin 1.2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter.
CVE-2010-4518 4.3Cross-site scripting (XSS) vulnerability in wp-safe-search/wp-safe-search-jx.php in the Safe Search plugin 0.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the v1 parameter.
CVE-2010-4403 5.0The Register Plus plugin 3.5.1 and earlier for WordPress allows remote attackers to obtain sensitive information via a direct request to (1) dash_widget.php and (2) register-plus.php, which reveals the installation path in an error message.
CVE-2010-4402 4.3Multiple cross-site scripting (XSS) vulnerabilities in wp-login.php in the Register Plus plugin 3.5.1 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) firstname, (2) lastname, (3) website, (4) aim, (5) yahoo, (6) jabber, (7) about, (8) pass1, and (9) pass2 parameters in a register action.
CVE-2010-4277 4.3Cross-site scripting (XSS) vulnerability in lembedded-video.php in the Embedded Video plugin 4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the content parameter to wp-admin/post.php.
CVE-2010-3977 4.3Multiple cross-site scripting (XSS) vulnerabilities in wp-content/plugins/cforms/lib_ajax.php in cforms WordPress plugin 11.5 allow remote attackers to inject arbitrary web script or HTML via the (1) rs and (2) rsargs[] parameters.
CVE-2010-2924 7.5SQL injection vulnerability in myLDlinker.php in the myLinksDump Plugin 1.2 for WordPress allows remote attackers to execute arbitrary SQL commands via the url parameter. NOTE: some of these details are obtained from third party information.
CVE-2010-1186 4.3Cross-site scripting (XSS) vulnerability in xml/media-rss.php in the NextGEN Gallery plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the mode parameter.
CVE-2010-0673 7.5SQL injection vulnerability in cplphoto.php in the Copperleaf Photolog plugin 0.16, and possibly earlier, for WordPress allows remote attackers to execute arbitrary SQL commands via the postid parameter.
CVE-2009-4748 7.5SQL injection vulnerability in mycategoryorder.php in the My Category Order plugin 2.8 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the parentID parameter in an act_OrderCategories action to wp-admin/post-new.php.
CVE-2009-4672 7.5Directory traversal vulnerability in main.php in the WP-Lytebox plugin 1.3 for WordPress allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the pg parameter.
CVE-2009-4424 7.5SQL injection vulnerability in results.php in the Pyrmont plugin 2 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2009-4170 5.0WP-Cumulus Plug-in 1.20 for WordPress, and possibly other versions, allows remote attackers to obtain sensitive information via a crafted request to wp-cumulus.php, probably without parameters, which reveals the installation path in an error message.
CVE-2009-4169 4.3Cross-site scripting (XSS) vulnerability in wp-cumulus.php in the WP-Cumulus Plug-in before 1.22 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2009-4168 4.3Cross-site scripting (XSS) vulnerability in Roy Tanck tagcloud.swf, as used in the WP-Cumulus plugin before 1.23 for WordPress and the Joomulus module 2.0 and earlier for Joomla!, allows remote attackers to inject arbitrary web script or HTML via the tagcloud parameter in a tags action. Cross-site scripting (XSS) vulnerability in tagcloud.swf in the WP-Cumulus Plug-in before 1.23 for WordPress allows remote attackers to inject arbitrary web script or HTML via the tagcloud parameter.
CVE-2009-3703 7.5Multiple SQL injection vulnerabilities in the WP-Forum plugin before 2.4 for WordPress allow remote attackers to execute arbitrary SQL commands via (1) the search_max parameter in a search action to the default URI, related to wpf.class.php; (2) the forum parameter to an unspecified component, related to wpf.class.php; (3) the topic parameter in a viewforum action to the default URI, related to the remove_topic function in wpf.class.php; or the id parameter in a (4) editpost or (5) viewtopic action to the default URI, related to wpf-post.php.
CVE-2009-2852 6.8WP-Syntax plugin 0.9.1 and earlier for Wordpress, with register_globals enabled, allows remote attackers to execute arbitrary PHP code via the test_filter[wp_head] array parameter to test/index.php, which is used in a call to the call_user_func_array function.
CVE-2009-2396 9.3PHP remote file inclusion vulnerability in template/album.php in DM Albums 1.9.2, as used standalone or as a WordPress plugin, allows remote attackers to execute arbitrary PHP code via a URL in the SECURITY_FILE parameter.
CVE-2009-2383 7.5SQL injection vulnerability in BTE_RW_webajax.php in the Related Sites plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the guid parameter.
CVE-2009-2144 7.5SQL injection vulnerability in the FireStats plugin before 1.6.2-stable for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2009-2143 7.5PHP remote file inclusion vulnerability in firestats-wordpress.php in the FireStats plugin before 1.6.2-stable for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the fs_javascript parameter.
CVE-2009-2122 7.5SQL injection vulnerability in viewimg.php in the Paolo Palmonari Photoracer plugin 1.0 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2009-0968 7.5SQL injection vulnerability in fmoblog.php in the fMoblog plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php. NOTE: some of these details are obtained from third party information.
CVE-2008-7175 4.3Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in NextGEN Gallery 0.96 and earlier plugin for Wordpress allows remote attackers to inject arbitrary web script or HTML via the picture description field in a page edit action.
CVE-2008-7040 7.5SQL injection vulnerability in ahah/sf-profile.php in the Yellow Swordfish Simple Forum module for Wordpress allows remote attackers to execute arbitrary SQL commands via the u parameter. NOTE: this issue was disclosed by an unreliable researcher, so the details might be incorrect.
CVE-2008-6811 6.8Unrestricted file upload vulnerability in image_processing.php in the e-Commerce Plugin 3.4 and earlier for Wordpress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/plugins/wp-shopping-cart/.
CVE-2008-5752 4.3Directory traversal vulnerability in getConfig.php in the Page Flip Image Gallery plugin 0.2.2 and earlier for WordPress, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the book_id parameter. NOTE: some of these details are obtained from third party information.
CVE-2008-4734 7.5Cross-site request forgery (CSRF) vulnerability in the wpcr_do_options_page function in WP Comment Remix plugin before 1.4.4 for WordPress allows remote attackers to perform unauthorized actions as administrators via a request that sets the wpcr_hidden_form_input parameter.
CVE-2008-4733 4.3Cross-site scripting (XSS) vulnerability in wpcommentremix.php in WP Comment Remix plugin before 1.4.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the (1) replytotext, (2) quotetext, (3) originallypostedby, (4) sep, (5) maxtags, (6) tagsep, (7) tagheadersep, (8) taglabel, and (9) tagheaderlabel parameters.
CVE-2008-4732 7.5SQL injection vulnerability in ajax_comments.php in the WP Comment Remix plugin before 1.4.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the p parameter.
CVE-2008-4625 7.5SQL injection vulnerability in stnl_iframe.php in the ShiftThis Newsletter (st_newsletter) plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the newsletter parameter, a different vector than CVE-2008-0683.
CVE-2008-1982 7.5SQL injection vulnerability in ss_load.php in the Spreadsheet (wpSS) 0.6 and earlier plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the ss_id parameter.
CVE-2007-5800 6.8Multiple PHP remote file inclusion vulnerabilities in the BackUpWordPress 0.4.2b and earlier plugin for WordPress allow remote attackers to execute arbitrary PHP code via a URL in the bkpwp_plugin_path parameter to (1) plugins/BackUp/Archive.php; and (2) Predicate.php, (3) Writer.php, (4) Reader.php, and other unspecified scripts under plugins/BackUp/Archive/.
CVE-2007-2627 6.8Cross-site scripting (XSS) vulnerability in sidebar.php in WordPress, when custom 404 pages that call get_sidebar are used, allows remote attackers to inject arbitrary web script or HTML via the query string (PHP_SELF), a different vulnerability than CVE-2007-1622.
935758949 | 2024-05-06T14:21:08.010769
  
25 / tcp
-2007201178 | 2024-04-25T18:00:39.298166
  
43 / tcp
-1694074412 | 2024-05-09T19:50:41.653806
  
80 / tcp
-1646502456 | 2024-05-10T19:59:26.592006
  
81 / tcp
-850651668 | 2024-04-21T21:52:38.101341
  
82 / tcp
1685524590 | 2024-05-08T23:40:26.777282
  
83 / tcp
-1700872795 | 2024-05-11T03:40:57.973590
  
84 / tcp
2145034109 | 2024-05-11T19:45:43.578691
  
88 / tcp
-630712508 | 2024-05-12T02:59:43.405360
  
389 / tcp
1053618816 | 2024-05-14T04:24:15.949438
  
443 / tcp
1224863060 | 2024-05-12T18:16:55.077953
  
444 / tcp
3423892 | 2024-04-25T01:26:16.853246
  
465 / tcp
1085887370 | 2024-05-05T13:24:23.348477
  
554 / tcp
-1300487243 | 2024-05-12T15:23:44.934302
  
587 / tcp
-1100989520 | 2024-05-12T18:56:50.538483
  
631 / tcp
-1255270311 | 2024-05-04T20:44:25.555312
  
636 / tcp
-805217095 | 2024-05-07T10:59:21.136225
  
1024 / tcp
-1588820223 | 2024-05-12T06:49:46.512787
  
1177 / tcp
-847684818 | 2024-05-06T00:23:16.166232
  
1234 / tcp
1565806785 | 2024-05-09T23:27:10.012207
  
1337 / tcp
1965069338 | 2024-04-26T12:32:52.749075
  
1400 / tcp
-2097417721 | 2024-04-27T17:15:14.108803
  
1433 / tcp
1390145042 | 2024-05-14T01:15:18.319383
  
1521 / tcp
-1943420058 | 2024-05-13T13:31:49.413384
  
1935 / tcp
-1642131996 | 2024-05-13T20:25:29.615468
  
2000 / tcp
1495443873 | 2024-05-09T15:38:22.063623
  
2082 / tcp
-1947432590 | 2024-05-12T18:05:56.954901
  
2083 / tcp
548870207 | 2024-05-08T20:52:44.719043
  
2086 / tcp
316137584 | 2024-04-26T16:20:35.400395
  
2087 / tcp
55317292 | 2024-04-25T20:45:40.794530
  
2222 / tcp
-167104014 | 2024-05-13T20:59:58.446953
  
2345 / tcp
2007390357 | 2024-05-07T10:59:39.675729
  
2375 / tcp
18692832 | 2024-05-07T22:14:13.797830
  
2376 / tcp
-1149651803 | 2024-05-12T08:51:10.573142
  
2404 / tcp
-1766265046 | 2024-05-13T05:56:57.801077
  
2480 / tcp
-1887402441 | 2024-05-12T14:12:36.739228
  
2628 / tcp
636334743 | 2024-05-08T19:51:49.560527
  
2761 / tcp
-285888747 | 2024-05-09T11:52:11.197946
  
3000 / tcp
-1190107893 | 2024-05-09T14:39:32.484435
  
3001 / tcp
377398202 | 2024-05-13T22:25:58.874136
  
3050 / tcp
-39323152 | 2024-05-11T16:32:12.457733
  
3268 / tcp
-979932105 | 2024-05-13T03:02:38.811941
  
3269 / tcp
904413534 | 2024-05-13T09:14:56.143810
  
3299 / tcp
781691342 | 2024-05-12T11:11:53.977763
  
3333 / tcp
176413116 | 2024-05-10T06:25:23.473013
  
3389 / tcp
-1553386008 | 2024-05-01T05:28:50.054535
  
3790 / tcp
-798093248 | 2024-05-03T18:21:23.049677
  
4000 / tcp
-1548793703 | 2024-04-27T01:25:21.588585
  
4022 / tcp
1526207067 | 2024-05-12T16:06:09.710947
  
4040 / tcp
0 | 2024-05-08T09:47:10.513215
  
4064 / tcp
442416022 | 2024-05-12T00:58:11.182093
  
4443 / tcp
-1541114015 | 2024-04-25T19:54:38.082579
  
4444 / tcp
658667143 | 2024-05-13T16:28:16.441250
  
4500 / tcp
1476587911 | 2024-04-30T16:43:58.999493
  
4567 / tcp
-946100914 | 2024-05-13T13:35:18.590497
  
4848 / tcp
-2023616702 | 2024-04-23T08:44:41.365193
  
4911 / tcp
1902451359 | 2024-05-14T00:24:31.353983
  
5000 / tcp
1688283266 | 2024-05-06T22:55:05.326516
  
5001 / tcp
92854900 | 2024-05-07T00:47:21.222299
  
5005 / tcp
2016831093 | 2024-05-06T18:28:48.817187
  
5006 / tcp
-759036971 | 2024-05-13T17:37:43.163922
  
5007 / tcp
-1847862599 | 2024-04-27T15:50:07.919008
  
5009 / tcp
-1547727215 | 2024-05-09T08:58:58.372634
  
5010 / tcp
1129330661 | 2024-05-14T08:51:57.135392
  
5201 / tcp
1775481402 | 2024-05-08T08:35:19.905985
  
5222 / tcp
1216108112 | 2024-05-14T01:05:54.266157
  
5555 / tcp
1704325552 | 2024-04-21T14:20:01.430655
  
5560 / tcp
-840964512 | 2024-05-03T14:16:48.143505
  
5601 / tcp
-53791532 | 2024-05-08T09:39:45.320901
  
5672 / tcp
2048253227 | 2024-05-11T13:10:38.717682
  
5900 / tcp
-167421024 | 2024-05-05T03:07:33.255828
  
5985 / tcp
1938073802 | 2024-05-12T18:47:42.220792
  
5986 / tcp
-358393820 | 2024-05-12T21:59:43.233697
  
6000 / tcp
-1737437165 | 2024-05-06T00:09:17.862540
  
6001 / tcp
-39806668 | 2024-05-12T03:13:07.197124
  
6080 / tcp
-317571613 | 2024-05-10T18:47:40.122924
  
6443 / tcp
-59190181 | 2024-05-11T21:36:24.005604
  
7071 / tcp
-1505565622 | 2024-05-07T08:23:08.366251
  
7171 / tcp
-246880053 | 2024-04-27T01:08:44.938717
  
7443 / tcp
574233269 | 2024-05-02T09:51:20.381112
  
7474 / tcp
1391672410 | 2024-05-10T22:41:42.617057
  
7547 / tcp
577554084 | 2024-05-13T13:25:43.795606
  
7548 / tcp
-750273769 | 2024-05-12T03:22:18.688975
  
7777 / tcp
-944668110 | 2024-04-28T01:21:59.775882
  
7779 / tcp
-390136987 | 2024-05-04T14:57:01.387232
  
8000 / tcp
199267175 | 2024-05-04T10:10:02.035636
  
8001 / tcp
-1337146273 | 2024-05-01T12:16:02.539275
  
8008 / tcp
647522099 | 2024-05-06T01:12:37.660026
  
8009 / tcp
-936523251 | 2024-05-13T14:01:36.889351
  
8010 / tcp
2084250040 | 2024-05-11T06:00:41.933160
  
8060 / tcp
1107770003 | 2024-05-03T02:38:35.804741
  
8069 / tcp
-613672382 | 2024-04-14T16:03:40.381999
  
8080 / tcp
631407556 | 2024-05-11T15:39:18.322428
  
8081 / tcp
2072869044 | 2024-05-03T02:25:24.717214
  
8082 / tcp
-639398872 | 2024-05-12T22:04:21.218124
  
8085 / tcp
-672254399 | 2024-05-13T10:42:47.140735
  
8086 / tcp
1806383347 | 2024-05-13T08:48:51.120952
  
8089 / tcp
1254035677 | 2024-05-09T19:56:00.767705
  
8090 / tcp
1173341412 | 2024-05-04T20:08:43.823653
  
8098 / tcp
-614597607 | 2024-05-02T15:45:56.903690
  
8099 / tcp
125136417 | 2024-05-09T23:34:35.588621
  
8112 / tcp
-1468679991 | 2024-05-14T07:58:24.269424
  
8123 / tcp
-1753139828 | 2024-04-30T00:56:56.761838
  
8126 / tcp
1618957705 | 2024-04-29T00:45:52.799274
  
8139 / tcp
2094716131 | 2024-05-12T00:36:44.805249
  
8140 / tcp
-1762341201 | 2024-05-04T05:39:06.512371
  
8181 / tcp
252569065 | 2024-05-08T05:41:51.158226
  
8200 / tcp
-960423679 | 2024-05-13T21:49:02.297107
  
8443 / tcp
1038250559 | 2024-05-10T19:25:49.196300
  
8800 / tcp
-571760343 | 2024-05-12T06:47:35.241673
  
8834 / tcp
1338940863 | 2024-05-04T18:05:43.600999
  
8888 / tcp
1189132076 | 2024-05-08T15:03:59.502132
  
8889 / tcp
819587727 | 2024-05-08T21:26:49.275159
  
9000 / tcp
954843265 | 2024-05-09T02:52:57.220161
  
9001 / tcp
1897198778 | 2024-05-11T06:47:54.182274
  
9002 / tcp
1598421466 | 2024-05-08T09:18:48.273226
  
9009 / tcp
2130099055 | 2024-05-11T04:48:37.581783
  
9080 / tcp
973512737 | 2024-05-14T01:09:57.124500
  
9090 / tcp
1189429373 | 2024-05-12T04:33:29.625216
  
9091 / tcp
-441907153 | 2024-05-12T07:45:31.444093
  
9095 / tcp
2107202260 | 2024-05-02T03:15:06.810515
  
9100 / tcp
522956237 | 2024-05-14T01:31:19.280790
  
9200 / tcp
1517586665 | 2024-05-13T21:29:31.583074
  
9306 / tcp
-80603179 | 2024-05-07T04:52:31.984355
  
9443 / tcp
1786480755 | 2024-05-10T14:54:34.593346
  
9876 / tcp
1970994390 | 2024-05-08T09:51:03.607086
  
9943 / tcp
-1203492025 | 2024-05-01T11:45:51.656904
  
9998 / tcp
155211128 | 2024-05-08T22:09:04.952058
  
9999 / tcp
-180316889 | 2024-05-14T06:09:27.372714
  
10000 / tcp
-1920020206 | 2024-05-13T03:51:58.559031
  
10001 / tcp
-2067028711 | 2024-05-02T18:05:57.852947
  
10134 / tcp
-1474964608 | 2024-05-12T15:42:53.386692
  
10443 / tcp
2050080004 | 2024-05-09T03:00:27.585158
  
12345 / tcp
-1339065416 | 2024-05-06T23:01:06.246170
  
13579 / tcp
-54081746 | 2024-04-21T19:42:30.298689
  
14265 / tcp
1199790202 | 2024-05-06T02:01:38.975278
  
16010 / tcp
-936985303 | 2024-05-10T23:43:29.223712
  
16030 / tcp
-1094429189 | 2024-04-20T20:07:00.507451
  
20000 / tcp
-1545585854 | 2024-05-06T21:44:15.988963
  
31337 / tcp
-79913722 | 2024-05-11T01:16:08.716120
  
50000 / tcp
1721670936 | 2024-05-09T16:04:27.713711
  
55000 / tcp
1783260739 | 2024-05-08T05:58:51.876306
  
55443 / tcp
-1927845145 | 2024-05-11T13:03:29.241955
  
60001 / tcp



Contact Us

Shodan ® - All rights reserved