rainbutterfly/cve_corpus huggingface dataset:
CVE-2015-9243 
When server level, connection level or route level CORS configurations in hapi node module before 11.1.4 are combined and when a higher level config included security restrictions (like origin), a higher level config that included security restrictions (like origin) would have those restrictions overridden by less restrictive defaults (e.g. origin defaults to all origins `*`).
Problem types: cwe_id: CWE-284
description: Improper Access Control - Generic (CWE-284)
Affected products: vendor: HackerOne
product: hapi node module
Published: 2018-05-29T20:00:00.000Z
CVE-2015-9244 
Keys of objects in mysql node module v2.0.0-alpha7 and earlier are not escaped with `mysql.escape()` which could lead to SQL Injection.
Problem types: cwe_id: CWE-89
description: SQL Injection (CWE-89)
Affected products: vendor: HackerOne
product: mysql node module
Published: 2018-05-29T20:00:00.000Z
CVE-2015-9245 
Insecure default configuration in Progress Software OpenEdge 10.2x and 11.x allows unauthenticated remote attackers to specify arbitrary URLs from which to load and execute malicious Java classes via port 20931.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-31T07:00:00.000Z
CVE-2015-9246 
An issue was discovered in Skybox Platform before 7.5.201. Remote Unauthenticated Code Execution exists via a WAR archive containing a JSP file. The WAR file is sent to /skyboxview-softwareupdate/services/CollectorSoftwareUpdate and the JSP file is reached at /opt/skyboxview/thirdparty/jboss/server/web/work/jboss.web/localhost.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-12T22:00:00.000Z
CVE-2015-9247 
An issue was discovered in Skybox Platform before 7.5.401. Reflected cross-site scripting vulnerabilities exist in /skyboxview/webservice/services/VersionRepositoryWebService via a soapenv:Body element, or in the status parameter to login.html.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-12T22:00:00.000Z
CVE-2015-9248 
An issue was discovered in Skybox Platform before 7.5.201. Stored cross-site scripting vulnerabilities exist in the title, Comments, or Description field to /skyboxview/webskybox/tickets in Change Manager.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-12T22:00:00.000Z
CVE-2015-9249 
An issue was discovered in Skybox Platform before 7.5.201. SQL Injection exists in /skyboxview/webservice/services/VersionWebService via a soapenv:Body element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-12T22:00:00.000Z
CVE-2015-9250 
An issue was discovered in Skybox Platform before 7.5.201. Directory Traversal exists in /skyboxview/webskybox/attachmentdownload and /skyboxview/webskybox/filedownload via the tempFileName parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-12T22:00:00.000Z
CVE-2015-9251 
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-18T23:00:00.000Z
CVE-2015-9252 
An issue was discovered in QPDF before 7.0.0. Endless recursion causes stack exhaustion in QPDFTokenizer::resolveLiteral() in QPDFTokenizer.cc, related to the QPDF::resolve function in QPDF.cc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-13T19:00:00.000Z
CVE-2015-9253 
An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20. The php-fpm master process restarts a child process in an endless loop when using program execution functions (e.g., passthru, exec, shell_exec, or system) with a non-blocking STDIN stream, causing this master process to consume 100% of the CPU, and consume disk space with a large volume of error logs, as demonstrated by an attack by a customer of a shared-hosting facility.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-19T19:00:00.000Z
CVE-2015-9254 
Datto ALTO and SIRIS devices have a default VNC password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-20T06:00:00.000Z
CVE-2015-9255 
Datto ALTO and SIRIS devices allow remote attackers to obtain sensitive information about data, software versions, configuration, and virtual machines via a request to a Web Virtual Directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-20T06:00:00.000Z
CVE-2015-9256 
Datto ALTO and SIRIS devices allow remote attackers to obtain sensitive information via access to device/VM restore mount points, because they do not have ACLs by default.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-20T06:00:00.000Z
CVE-2015-9257 
BMC Remedy Action Request (AR) System 9.0 before 9.0.00 Service Pack 2 hot fix 1 has persistent XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-24T20:00:00.000Z
CVE-2015-9258 
In Docker Notary before 0.1, gotuf/signed/verify.go has a Signature Algorithm Not Matched to Key vulnerability. Because an attacker controls the field specifying the signature algorithm, they might (for example) be able to forge a signature by forcing a misinterpretation of an RSA-PSS key as Ed25519 elliptic-curve data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-31T21:00:00.000Z
CVE-2015-9259 
In Docker Notary before 0.1, the checkRoot function in gotuf/client/client.go does not check expiry of root.json files, despite a comment stating that it does. Even if a user creates a new root.json file after a key compromise, an attacker can produce update files referring to an old root.json file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-31T21:00:00.000Z
CVE-2015-9260 
An issue was discovered in BEdita before 3.7.0. A cross-site scripting (XSS) attack occurs via a crafted pages/showObjects URI, as demonstrated by appending a payload to a pages/showObjects/2/0/0/leafs URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-05T02:00:00.000Z
CVE-2015-9261 
huft_build in archival/libarchive/decompress_gunzip.c in BusyBox before 1.27.2 misuses a pointer, causing segfaults and an application crash during an unzip operation on a specially crafted ZIP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-26T19:00:00.000Z
CVE-2015-9262 
_XcursorThemeInherits in library.c in libXcursor before 1.1.15 allows remote attackers to cause denial of service or potentially code execution via a one-byte heap overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-01T23:00:00.000Z
CVE-2015-9263 
An issue was discovered in post2file.php in Up.Time Monitoring Station 7.5.0 (build 16) and 7.4.0 (build 13). It allows an attacker to upload an arbitrary file, such as a .php file that can execute arbitrary OS commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-27T04:00:00.000Z
CVE-2015-9264 
Lansweeper 4.x through 6.x before 6.0.0.48 allows attackers to execute arbitrary code on the administrator's workstation via a crafted Windows service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-27T04:00:00.000Z
CVE-2015-9266 Ubiquiti airOS HTTP(S) unauthenticated arbitrary file upload
The web management interface of Ubiquiti airMAX, airFiber, airGateway and EdgeSwitch XP (formerly TOUGHSwitch) allows an unauthenticated attacker to upload and write arbitrary files using directory traversal techniques. An attacker can exploit this vulnerability to gain root privileges. This vulnerability is fixed in the following product versions (fixes released in July 2015, all prior versions are affected): airMAX AC 7.1.3; airMAX M (and airRouter) 5.6.2 XM/XW/TI, 5.5.11 XM/TI, and 5.5.10u2 XW; airGateway 1.1.5; airFiber AF24/AF24HD 2.2.1, AF5x 3.0.2.1, and AF5 2.2.1; airOS 4 XS2/XS5 4.0.4; and EdgeSwitch XP (formerly TOUGHSwitch) 1.3.2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Credits: lang: en
value: This vulnerability was reported by 93c08539.
Published: 2018-09-05T21:00:00.000Z
CVE-2015-9267 
Nullsoft Scriptable Install System (NSIS) before 2.49 uses temporary folder locations that allow unprivileged local users to overwrite files. This allows a local attack in which either a plugin or the uninstaller can be replaced by a Trojan horse program.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-01T08:00:00.000Z
CVE-2015-9268 
Nullsoft Scriptable Install System (NSIS) before 2.49 has unsafe implicit linking against Version.dll. In other words, there is no protection mechanism in which a wrapper function resolves the dependency at an appropriate time during runtime.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-01T08:00:00.000Z
CVE-2015-9269 
The export/content.php exportarticle feature in the wordpress-mobile-pack plugin before 2.1.3 2015-06-03 for WordPress allows remote attackers to obtain sensitive information because the content of a privately published post is sent in JSON format.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-01T23:00:00.000Z
CVE-2015-9270 
XSS exists in the the-holiday-calendar plugin before 1.11.3 for WordPress via the thc-month parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-01T23:00:00.000Z
CVE-2015-9271 
The VideoWhisper videowhisper-video-conference-integration plugin 4.91.8 for WordPress allows remote attackers to execute arbitrary code because vc/vw_upload.php considers a file safe when "html" are the last four characters, as demonstrated by a .phtml file containing PHP code, a different vulnerability than CVE-2014-1905.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-04T23:00:00.000Z
CVE-2015-9272 
The videowhisper-video-presentation plugin 3.31.17 for WordPress allows remote attackers to execute arbitrary code because vp/vw_upload.php considers a file safe when "html" are the last four characters, as demonstrated by a .phtml file containing PHP code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-05T05:00:00.000Z
CVE-2015-9273 
The wp-slimstat (aka Slimstat Analytics) plugin before 4.1.6.1 for WordPress has XSS via an HTTP Referer header, or via a field associated with JavaScript-based Referer tracking.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-07T17:00:00.000Z
CVE-2015-9274 
HarfBuzz before 1.0.4 allows remote attackers to cause a denial of service (invalid read of two bytes and application crash) because of GPOS and GSUB table mishandling, related to hb-ot-layout-gpos-table.hh, hb-ot-layout-gsub-table.hh, and hb-ot-layout-gsubgpos-private.hh.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-15T05:00:00.000Z
CVE-2015-9275 
ARC 5.21q allows directory traversal via a full pathname in an archive file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-07T18:00:00.000Z
CVE-2015-9276 
SmarterTools SmarterMail before 13.3.5535 was vulnerable to stored XSS by bypassing the anti-XSS mechanisms. It was possible to run JavaScript code when a victim user opens or replies to the attacker's email, which contained a malicious payload. Therefore, users' passwords could be reset by using an XSS attack, as the password reset page did not need the current password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-16T16:00:00.000Z
CVE-2015-9277 
MailEnable before 8.60 allows Directory Traversal for reading the messages of other users, uploading files, and deleting files because "/../" and "/.. /" are mishandled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-16T16:00:00.000Z
CVE-2015-9278 
MailEnable before 8.60 allows Privilege Escalation because admin accounts could be created as a consequence of %0A mishandling in AUTH.TAB after a password-change request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-16T16:00:00.000Z
CVE-2015-9279 
MailEnable before 8.60 allows Stored XSS via malformed use of "<img/src" with no ">" character in the body of an e-mail message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-16T16:00:00.000Z
CVE-2015-9280 
MailEnable before 8.60 allows XXE via an XML document in the request.aspx Options parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-16T16:00:00.000Z
CVE-2015-9281 
Logon Manager in SAS Web Infrastructure Platform before 9.4M3 allows reflected XSS on the Timeout page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-17T01:00:00.000Z
CVE-2015-9282 
The Pie Chart Panel plugin through 2019-01-02 for Grafana is vulnerable to XSS via legend data or tooltip data. When a chart is included in a Grafana dashboard, this vulnerability could allow an attacker to gain remote unauthenticated access to the dashboard.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-06T19:00:00.000Z
CVE-2015-9284 
The request phase of the OmniAuth Ruby gem (1.9.1 and earlier) is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on Rails framework, allowing accounts to be connected without user intent, user interaction, or feedback to the user. This permits a secondary account to be able to sign into the web application as the primary account.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF) (CWE-352)
Affected products: vendor: n/a
product: omniauth ruby gem
Published: 2019-04-26T14:03:53.000Z
CVE-2015-9285 
esoTalk 1.0.0g4 has XSS via the PATH_INFO to the conversations/ URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-29T13:47:07.000Z
CVE-2015-9286 
Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-30T13:07:10.000Z
CVE-2015-9287 
Directory Traversal was discovered in University of Cambridge mod_ucam_webauth before 2.0.2. The key identification field ("kid") of the IdP's HTTP response message ("WLS-Response") can be manipulated by an attacker. The "kid" field is not signed like the rest of the message, and manipulation is therefore trivial. The "kid" field should only ever represent an integer. However, it is possible to provide any string value. An attacker could use this to their advantage to force the application agent to load the RSA public key required for message integrity checking from an unintended location.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-13T15:44:06.000Z
CVE-2015-9288 
The Unity Web Player plugin before 4.6.6f2 and 5.x before 5.0.3f2 allows attackers to read messages or access online services via a victim's credentials
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-29T15:28:09.000Z
CVE-2015-9289 
In the Linux kernel before 4.1.4, a buffer overflow occurs when checking userspace params in drivers/media/dvb-frontends/cx24116.c. The maximum size for a DiSEqC command is 6, according to the userspace API. However, the code allows larger values such as 23.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-27T21:38:59.000Z
CVE-2015-9290 
In FreeType before 2.6.1, a buffer over-read occurs in type1/t1parse.c on function T1_Get_Private_Dict where there is no check that the new values of cur and limit are sensible before going to Again.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-30T12:36:19.000Z
CVE-2015-9291 
cPanel before 11.52.0.13 does not prevent arbitrary file-read operations via get_information_for_applications (CPANEL-1221).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-01T14:34:03.000Z
CVE-2015-9292 
6kbbs 7.1 and 8.0 allows CSRF via portalchannel_ajax.php (id or code parameter) or admin.php (fileids parameter).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-08T20:01:42.000Z
CVE-2015-9293 
The all-in-one-wp-security-and-firewall plugin before 3.9.8 for WordPress has XSS in the unlock request feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-13T16:52:23.000Z
CVE-2015-9294 
The all-in-one-wp-security-and-firewall plugin before 3.9.5 for WordPress has XSS in add_query_arg and remove_query_arg function instances.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-13T16:51:48.000Z
CVE-2015-9295 
The contact-form-plugin plugin before 3.96 for WordPress has XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-13T16:48:27.000Z
CVE-2015-9296 
The download-monitor plugin before 1.7.1 for WordPress has XSS related to add_query_arg.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-13T16:44:06.000Z
CVE-2015-9297 
The events-manager plugin before 5.6 for WordPress has XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-13T16:43:30.000Z
CVE-2015-9298 
The events-manager plugin before 5.6 for WordPress has code injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-13T16:42:49.000Z
CVE-2015-9299 
The events-manager plugin before 5.5.7.1 for WordPress has DOM XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-13T16:42:18.000Z
CVE-2015-9300 
The events-manager plugin before 5.5.7 for WordPress has multiple XSS issues.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-13T16:41:40.000Z
CVE-2015-9301 
The liveforms plugin before 3.2.0 for WordPress has SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-13T16:37:00.000Z
CVE-2015-9302 
The simple-fields plugin before 1.4.11 for WordPress has XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-13T16:35:24.000Z
CVE-2015-9303 
The simple-share-buttons-adder plugin before 6.0.0 for WordPress has XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-12T15:40:33.000Z
CVE-2015-9304 
The ultimate-member plugin before 1.3.18 for WordPress has XSS via text input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-12T15:23:04.000Z
CVE-2015-9305 
The wp-google-map-plugin plugin before 2.3.7 for WordPress has XSS related to the add_query_arg() and remove_query_arg() functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-12T14:51:50.000Z
CVE-2015-9306 
The wp-ultimate-csv-importer plugin before 3.8.1 for WordPress has XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-12T14:41:35.000Z
CVE-2015-9307 
The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit location feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-14T15:24:45.000Z
CVE-2015-9308 
The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit map feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-14T15:23:11.000Z
CVE-2015-9309 
The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit category feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-14T15:22:44.000Z
CVE-2015-9310 
The all-in-one-wp-security-and-firewall plugin before 3.9.1 for WordPress has multiple SQL injection issues.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-14T15:17:55.000Z
CVE-2015-9311 
The newstatpress plugin before 1.0.6 for WordPress has reflected XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-14T14:54:52.000Z
CVE-2015-9312 
The newstatpress plugin before 1.0.5 for WordPress has XSS related to an IMG element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-14T14:54:08.000Z
CVE-2015-9313 
The newstatpress plugin before 1.0.5 for WordPress has SQL injection related to an IMG element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-14T14:53:16.000Z
CVE-2015-9314 
The newstatpress plugin before 1.0.4 for WordPress has XSS related to the Referer header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-14T14:52:46.000Z
CVE-2015-9315 
The newstatpress plugin before 1.0.1 for WordPress has SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-14T14:51:56.000Z
CVE-2015-9316 
The wp-fastest-cache plugin before 0.8.4.9 for WordPress has SQL injection in wp-admin/admin-ajax.php?action=wpfc_wppolls_ajax_request via the poll_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-14T14:48:11.000Z
CVE-2015-9317 
The awesome-support plugin before 3.1.7 for WordPress has XSS via custom information messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-20T14:34:46.000Z
CVE-2015-9318 
The awesome-support plugin before 3.1.7 for WordPress has a security issue in which shortcodes are allowed in replies.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-20T14:47:21.000Z
CVE-2015-9319 
The gregs-high-performance-seo plugin before 1.6.2 for WordPress has XSS in the context of an old browser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-20T15:19:23.000Z
CVE-2015-9320 
The option-tree plugin before 2.5.4 for WordPress has XSS related to add_query_arg.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-20T15:42:08.000Z
CVE-2015-9321 
The shortcode-factory plugin before 1.1.1 for WordPress has XSS via add_query_arg.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-21T11:49:23.000Z
CVE-2015-9322 
The erident-custom-login-and-dashboard plugin before 3.5 for WordPress has CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-16T20:19:50.000Z
CVE-2015-9323 
The 404-to-301 plugin before 2.0.3 for WordPress has SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-16T20:12:59.000Z
CVE-2015-9324 
The easy-digital-downloads plugin before 2.3.3 for WordPress has SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-16T20:10:59.000Z
CVE-2015-9325 
The visitors-online plugin before 0.4 for WordPress has SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-16T13:41:16.000Z