Description

Wordpress before 2.8.3 allows remote attackers to gain privileges via a direct request to (1) admin-footer.php, (2) edit-category-form.php, (3) edit-form-advanced.php, (4) edit-form-comment.php, (5) edit-link-category-form.php, (6) edit-link-form.php, (7) edit-page-form.php, and (8) edit-tag-form.php in wp-admin/.

Remediation

References

CVE-2009-2853

Related Vulnerabilities

Joomla! Core 3.x.x Multiple Vulnerabilities (3.7.0 - 3.8.3)

WordPress Plugin AccessPress Social Counter includes Backdoor [Only if downloaded via the vendor website] (1.9.1)

WordPress Plugin SP Rental Manager SQL Injection (1.5.3)

Roundcube Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-46144)

MediaWiki Improper Neutralization of Special Elements used in a Command ('Command Injection') Vulnerability (CVE-2014-9277)

Severity

Critical

Classification

CVE-2009-2853 CWE-264

Tags

Missing Update Known Vulnerabilities