CWE-434Vulnerability type

WordPress Arbitrary File Upload vulnerabilities (page 1372)

Upload handlers that accept PHP files, the shortest route from a plugin bug to a webshell.

WordPress Arbitrary File Upload vulnerabilities (page 1372)
Severity	Vulnerability	CVE	Installs	Published
Medium6.5	Directory Traversal WordPress<2.1Update to 2.1	CVE-2007-0541	—	Jan 24, 2007
Medium4.3	Denial of Service WordPress<2.1Update to 2.1	CVE-2007-0539	—	Jan 22, 2007
Medium5.3	Full Path Disclosure WordPress≤2.0.11Update to 2.1	CVE-2008-0195	—	Jan 22, 2007
High8.8	SQL Injection WordPress≤2.0.6Update to 2.0.7	CVE-2007-0233	—	Jan 15, 2007
Medium5.3	Full Path Disclosure WordPress≤2.0.6Update to 2.0.7	CVE-2007-0262	—	Jan 15, 2007
High8.8	Cross-Site Request Forgery to Cross-Site Scripting WordPress≤2.0.5Update to 2.0.6	CVE-2007-0106	—	Jan 5, 2007
Medium5.3	Username Enumeration via Error Messages WordPress≤2.0.5Update to 2.0.6	CVE-2007-0109	—	Jan 5, 2007
Medium5.3	2.0.5 - Sensitive Information Disclosure WordPress2.0.2 – 2.0.5Update to 2.0.6	CVE-2006-4743	—	Jan 5, 2007
Critical9.8	SQL Injection WordPress≤2.0.5Update to 2.0.6	CVE-2007-0107	—	Jan 5, 2007
Medium6.4	Cross-Site Scripting WordPress≤2.0.5Update to 2.0.6	CVE-2006-6808	—	Jan 5, 2007
Medium6.5	Directory Traversal WordPress≤2.0.4Update to 2.0.5	CVE-2006-5705	—	Oct 27, 2006
Medium6.5	Denial of Service WordPress≤2.0.4Update to 2.0.5	CVE-2006-6017	—	Oct 27, 2006
Medium6.1	Cross-Site Scripting Headway<3.8.9Update to 3.8.9	CVE-2016-10953	—	Oct 13, 2006
Medium4.3	User Metadata Information Disclosure WordPress≤2.0.4Update to 2.0.5	CVE-2006-6016	—	Sep 18, 2006
Medium6.1	Reflected Cross-Site Scripting Subscribe to Comments≤2.0.7Update to 2.0.8	CVE-2006-10001	—	Sep 17, 2006
Medium5.3	Full Path Disclosure WordPress<1.5.2Update to 1.5.2	CVE-2005-4463	—	Aug 14, 2006
Medium5.5	Authenticated (Admin+) Directory Traversal Skippy WP-DB Backup (Legacy Core Plugin)≤1.7No patch available	CVE-2006-4208	—	Aug 14, 2006
Medium5.3	Full Path Disclosure WordPress≤2.0.3Update to 2.0.4	CVE-2006-3390	—	Jul 29, 2006
Medium6.5	Denial of Service WordPress≤2.0.3Update to 2.0.4	CVE-2008-0194	—	Jul 29, 2006
Critical9.8	Privilege Escalation WordPress<2.0.4Update to 2.0.4	CVE-2006-4028	—	Jul 9, 2006
Medium5.3	IP Address Spoofing WordPress≤2.0.2Update to 2.0.3	CVE-2006-2702	—	Jun 1, 2006
High8.8	Remote Code Execution WordPress≤2.0.2Update to 2.0.3	CVE-2006-2667	—	Jun 1, 2006
High7.5	Sensitive Information Disclosure WordPress≤2.0.1Update to 2.0.2	CVE-2006-0986	—	Mar 10, 2006
High7.2	Cross-Site Scripting WordPress≤2.0.1Update to 2.0.2	CVE-2006-0985	—	Mar 10, 2006
Medium6.1	Reflected Cross-Site Scripting WordPress<2.0.2Update to 2.0.2	CVE-2006-1263	—	Mar 10, 2006
Medium6.1	Cross-Site Scripting WordPress<2.0.2Update to 2.0.2	CVE-2007-5105	—	Mar 10, 2006
Medium6.1	Cross-Site Scripting WordPress≤2.0Update to 2.0.1	CVE-2006-1796	—	Jan 31, 2006
High7.2	SQL Injection WordPress≤1.5.2Update to 2.0	CVE-2006-1012	—	Dec 31, 2005
Medium5.3	Directory Traversal secure-files≤1.1Update to 1.2	CVE-2005-10002	—	Oct 3, 2005
High8.8	Remote Code Execution WordPress≤1.5.1.3Update to 1.5.2	CVE-2005-2612	—	Aug 9, 2005

Medium6.5
Directory Traversal
WordPress
<2.1Update to 2.1
CVE-2007-0541Jan 24, 2007
Medium4.3
Denial of Service
WordPress
<2.1Update to 2.1
CVE-2007-0539Jan 22, 2007
Medium5.3
Full Path Disclosure
WordPress
≤2.0.11Update to 2.1
CVE-2008-0195Jan 22, 2007
High8.8
SQL Injection
WordPress
≤2.0.6Update to 2.0.7
CVE-2007-0233Jan 15, 2007
Medium5.3
Full Path Disclosure
WordPress
≤2.0.6Update to 2.0.7
CVE-2007-0262Jan 15, 2007
High8.8
Cross-Site Request Forgery to Cross-Site Scripting
WordPress
≤2.0.5Update to 2.0.6
CVE-2007-0106Jan 5, 2007
Medium5.3
Username Enumeration via Error Messages
WordPress
≤2.0.5Update to 2.0.6
CVE-2007-0109Jan 5, 2007
Medium5.3
2.0.5 - Sensitive Information Disclosure
WordPress
2.0.2 – 2.0.5Update to 2.0.6
CVE-2006-4743Jan 5, 2007
Critical9.8
SQL Injection
WordPress
≤2.0.5Update to 2.0.6
CVE-2007-0107Jan 5, 2007
Medium6.4
Cross-Site Scripting
WordPress
≤2.0.5Update to 2.0.6
CVE-2006-6808Jan 5, 2007
Medium6.5
Directory Traversal
WordPress
≤2.0.4Update to 2.0.5
CVE-2006-5705Oct 27, 2006
Medium6.5
Denial of Service
WordPress
≤2.0.4Update to 2.0.5
CVE-2006-6017Oct 27, 2006
Medium6.1
Cross-Site Scripting
Headway
<3.8.9Update to 3.8.9
CVE-2016-10953Oct 13, 2006
Medium4.3
User Metadata Information Disclosure
WordPress
≤2.0.4Update to 2.0.5
CVE-2006-6016Sep 18, 2006
Medium6.1
Reflected Cross-Site Scripting
Subscribe to Comments
≤2.0.7Update to 2.0.8
CVE-2006-10001Sep 17, 2006
Medium5.3
Full Path Disclosure
WordPress
<1.5.2Update to 1.5.2
CVE-2005-4463Aug 14, 2006
Medium5.5
Authenticated (Admin+) Directory Traversal
Skippy WP-DB Backup (Legacy Core Plugin)
≤1.7No patch available
CVE-2006-4208Aug 14, 2006
Medium5.3
Full Path Disclosure
WordPress
≤2.0.3Update to 2.0.4
CVE-2006-3390Jul 29, 2006
Medium6.5
Denial of Service
WordPress
≤2.0.3Update to 2.0.4
CVE-2008-0194Jul 29, 2006
Critical9.8
Privilege Escalation
WordPress
<2.0.4Update to 2.0.4
CVE-2006-4028Jul 9, 2006
Medium5.3
IP Address Spoofing
WordPress
≤2.0.2Update to 2.0.3
CVE-2006-2702Jun 1, 2006
High8.8
Remote Code Execution
WordPress
≤2.0.2Update to 2.0.3
CVE-2006-2667Jun 1, 2006
High7.5
Sensitive Information Disclosure
WordPress
≤2.0.1Update to 2.0.2
CVE-2006-0986Mar 10, 2006
High7.2
Cross-Site Scripting
WordPress
≤2.0.1Update to 2.0.2
CVE-2006-0985Mar 10, 2006
Medium6.1
Reflected Cross-Site Scripting
WordPress
<2.0.2Update to 2.0.2
CVE-2006-1263Mar 10, 2006
Medium6.1
Cross-Site Scripting
WordPress
<2.0.2Update to 2.0.2
CVE-2007-5105Mar 10, 2006
Medium6.1
Cross-Site Scripting
WordPress
≤2.0Update to 2.0.1
CVE-2006-1796Jan 31, 2006
High7.2
SQL Injection
WordPress
≤1.5.2Update to 2.0
CVE-2006-1012Dec 31, 2005
Medium5.3
Directory Traversal
secure-files
≤1.1Update to 1.2
CVE-2005-10002Oct 3, 2005
High8.8
Remote Code Execution
WordPress
≤1.5.1.3Update to 1.5.2
CVE-2005-2612Aug 9, 2005