Xen Mobile contains numerous unauthenticated file upload vulnerabilities
Severity: Medium
Advisories
Xen Mobile allows attackers to read arbitrary files
Severity: High
CMS Tree Page View allows any logged in users to move pages, regardless of permissions
Severity: Medium
WordPress does not hash or expire wp_signups.activation_key allowing an attacker with SQL injection to create accounts
Severity: Low
CSRF/XSS in Content Audit allowing an unauthenticated attacker to do almost anything an admin can
Severity: Medium
Stored XSS in Salutation Responsive WordPress + BuddyPress Theme could allow logged-in users to do almost anything an admin can
Severity: Medium
Stop User Enumeration allows user enumeration via the REST API
Severity: Medium
CSRF in YouTube (WordPress plugin) could allow unauthenticated attacker to change any setting within the plugin
Severity: Medium
Path traversal in Photo Gallery may allow admins to read most files on the filesystem
Severity: Medium
Reflected XSS in WordPress Download Manager could allow an attacker to do almost anything an admin can
Severity: Medium