# Vulnerabilities published in 2016


- [CVE-2016-10961](https://insights.sbomify.com/CVE-2016-10961/): Cross-site scripting in inkthemes:colorway (medium 6.1)
- [CVE-2016-10960](https://insights.sbomify.com/CVE-2016-10960/): Command injection in joomlaserviceprovider:wsecure (high 8.8)
- [CVE-2016-1096](https://insights.sbomify.com/CVE-2016-1096/): Other in adobe:flash player (high 7.5)
- [CVE-2016-10959](https://insights.sbomify.com/CVE-2016-10959/): File upload in estatik:estatik (medium 6.5)
- [CVE-2016-10958](https://insights.sbomify.com/CVE-2016-10958/): File upload in estatik:estatik (high 7.5)
- [CVE-2016-10957](https://insights.sbomify.com/CVE-2016-10957/): Cross-site scripting in akal project:akal (medium 6.1)
- [CVE-2016-10956](https://insights.sbomify.com/CVE-2016-10956/): Path traversal in mail-masta project:mail-masta (high 7.5)
- [CVE-2016-10955](https://insights.sbomify.com/CVE-2016-10955/): File upload in cysteme:cysteme-finder (critical 9.8)
- [CVE-2016-10954](https://insights.sbomify.com/CVE-2016-10954/): File upload in dynamicpress:neosense (critical 9.8)
- [CVE-2016-10953](https://insights.sbomify.com/CVE-2016-10953/): Cross-site scripting in headwaythemes:headway (medium 5.4)
- [CVE-2016-10952](https://insights.sbomify.com/CVE-2016-10952/): Cross-site scripting in quotes collection project:quotes collection (medium 6.1)
- [CVE-2016-10951](https://insights.sbomify.com/CVE-2016-10951/): SQL injection in firestormplugins:fs-shopping-cart (high 7.2)
- [CVE-2016-10950](https://insights.sbomify.com/CVE-2016-10950/): SQL injection in sirv:sirv (high 8.8)
- [CVE-2016-1095](https://insights.sbomify.com/CVE-2016-1095/): Memory corruption in adobe:acrobat (critical 9.8)
- [CVE-2016-10949](https://insights.sbomify.com/CVE-2016-10949/): SQL injection in relevanssi:relevanssi (high 8.8)
- [CVE-2016-10948](https://insights.sbomify.com/CVE-2016-10948/): Deserialization in post indexer project:post indexer (high 8.1)
- [CVE-2016-10947](https://insights.sbomify.com/CVE-2016-10947/): SQL injection in post indexer project:post indexer (high 7.2)
- [CVE-2016-10946](https://insights.sbomify.com/CVE-2016-10946/): Cross-site request forgery in wp-d3 project:wp-d3 (high 8.8)
- [CVE-2016-10945](https://insights.sbomify.com/CVE-2016-10945/): Cross-site request forgery in pagelines:pagelines (high 8.8)
- [CVE-2016-10944](https://insights.sbomify.com/CVE-2016-10944/): Cross-site request forgery in wpmaz:multisite post duplicator (high 8.8)
- [CVE-2016-10943](https://insights.sbomify.com/CVE-2016-10943/): SQL injection in zx-csv-upload project:zx-csv-upload (high 7.2)
- [CVE-2016-10942](https://insights.sbomify.com/CVE-2016-10942/): SQL injection in podlove:podlove podcast publisher (critical 9.8)
- [CVE-2016-10941](https://insights.sbomify.com/CVE-2016-10941/): Cross-site scripting in podlove:podlove podcast publisher (medium 6.1)
- [CVE-2016-10940](https://insights.sbomify.com/CVE-2016-10940/): SQL injection in zm-gallery project:zm-gallery (high 7.2)
- [CVE-2016-1094](https://insights.sbomify.com/CVE-2016-1094/): Use after free in adobe:acrobat dc (critical 9.8)
- [CVE-2016-10939](https://insights.sbomify.com/CVE-2016-10939/): SQL injection in xtremelocator:xtremelocator (high 7.2)
- [CVE-2016-10938](https://insights.sbomify.com/CVE-2016-10938/): Cross-site request forgery in copy-me project:copy-me (medium 6.5)
- [CVE-2016-10937](https://insights.sbomify.com/CVE-2016-10937/): Security feature bypass in debian:debian linux (high 7.5)
- [CVE-2016-10936](https://insights.sbomify.com/CVE-2016-10936/): Cross-site scripting in wp-polls project:wp-polls (medium 6.1)
- [CVE-2016-10935](https://insights.sbomify.com/CVE-2016-10935/): Privilege escalation in visser:store exporter for woocommerce (critical 9.8)
- [CVE-2016-10934](https://insights.sbomify.com/CVE-2016-10934/): Cross-site scripting in check email project:check email (medium 6.1)
- [CVE-2016-10933](https://insights.sbomify.com/CVE-2016-10933/): Source code is downloaded over cleartext HTTP in portaudio (medium 5.9)
- [CVE-2016-10932](https://insights.sbomify.com/CVE-2016-10932/): HTTPS MitM vulnerability due to lack of hostname verification (medium 4.8)
- [CVE-2016-10931](https://insights.sbomify.com/CVE-2016-10931/): Improper Certificate Validation in openssl (high 8.1)
- [CVE-2016-10930](https://insights.sbomify.com/CVE-2016-10930/): Missing authorization in wpsupportplus:wp support plus responsive ticket system (critical 9.8)
- [CVE-2016-1093](https://insights.sbomify.com/CVE-2016-1093/): Memory corruption in adobe:acrobat (critical 9.8)
- [CVE-2016-10929](https://insights.sbomify.com/CVE-2016-10929/): Missing authorization in advanced ajax page loader project:advanced ajax page loader (medium 5.3)
- [CVE-2016-10928](https://insights.sbomify.com/CVE-2016-10928/): Hardcoded credentials in onelogin:onelogin saml sso (high 7.5)
- [CVE-2016-10927](https://insights.sbomify.com/CVE-2016-10927/): Server-side request forgery in neliosoftware:nelio ab testing (critical 10.0)
- [CVE-2016-10926](https://insights.sbomify.com/CVE-2016-10926/): Server-side request forgery in neliosoftware:nelio ab testing (critical 10.0)
- [CVE-2016-10925](https://insights.sbomify.com/CVE-2016-10925/): Cross-site scripting in profilepress:loginwp (medium 6.1)
- [CVE-2016-10924](https://insights.sbomify.com/CVE-2016-10924/): Path traversal in zedna ebook download project:zedna ebook download (high 7.5)
- [CVE-2016-10923](https://insights.sbomify.com/CVE-2016-10923/): Privilege escalation in visser:store toolkit for woocommerce (critical 9.8)
- [CVE-2016-10922](https://insights.sbomify.com/CVE-2016-10922/): Privilege escalation in visser:store toolkit for woocommerce (critical 9.8)
- [CVE-2016-10921](https://insights.sbomify.com/CVE-2016-10921/): SQL injection in ays-pro:photo gallery (critical 9.8)
- [CVE-2016-10920](https://insights.sbomify.com/CVE-2016-10920/): Cross-site scripting in sir:gnucommerce (medium 6.1)
- [CVE-2016-1092](https://insights.sbomify.com/CVE-2016-1092/): Information disclosure in adobe:acrobat (high 7.5)
- [CVE-2016-10919](https://insights.sbomify.com/CVE-2016-10919/): Cross-site scripting in wassup real time analytics project:wassup real time analytics (medium 6.1)
- [CVE-2016-10918](https://insights.sbomify.com/CVE-2016-10918/): Cross-site request forgery in supsystic:photo gallery (high 8.8)
- [CVE-2016-10917](https://insights.sbomify.com/CVE-2016-10917/): SQL injection in search everything project:search everything (critical 9.8)
- [CVE-2016-10916](https://insights.sbomify.com/CVE-2016-10916/): SQL injection in codepeople:appointment booking calendar (critical 9.8)
- [CVE-2016-10915](https://insights.sbomify.com/CVE-2016-10915/): Cross-site request forgery in supsystic:popup (high 8.8)
- [CVE-2016-10914](https://insights.sbomify.com/CVE-2016-10914/): Cross-site request forgery in add from server project:add from server (high 8.8)
- [CVE-2016-10913](https://insights.sbomify.com/CVE-2016-10913/): Cross-site scripting in joomunited:wp latest posts (medium 6.1)
- [CVE-2016-10912](https://insights.sbomify.com/CVE-2016-10912/): Cross-site scripting in matchboxdesigngroup:universal analytics (medium 6.1)
- [CVE-2016-10911](https://insights.sbomify.com/CVE-2016-10911/): Cross-site scripting in cozmoslabs:profile builder (medium 6.1)
- [CVE-2016-10910](https://insights.sbomify.com/CVE-2016-10910/): Cross-site scripting in formbuilder project:formbuilder (medium 6.1)
- [CVE-2016-1091](https://insights.sbomify.com/CVE-2016-1091/): Use after free in adobe:acrobat (critical 9.8)
- [CVE-2016-10909](https://insights.sbomify.com/CVE-2016-10909/): SQL injection in codepeople:booking calendar contact form (critical 9.8)
- [CVE-2016-10908](https://insights.sbomify.com/CVE-2016-10908/): Cross-site scripting in codepeople:booking calendar contact form (medium 6.1)
- [CVE-2016-10907](https://insights.sbomify.com/CVE-2016-10907/): Memory corruption in linux:linux kernel (high 7.8)
- [CVE-2016-10906](https://insights.sbomify.com/CVE-2016-10906/): Use after free in linux:linux kernel (high 7.0)
- [CVE-2016-10905](https://insights.sbomify.com/CVE-2016-10905/): Use after free in linux:linux kernel (high 7.8)
- [CVE-2016-10904](https://insights.sbomify.com/CVE-2016-10904/): SQL injection in olimometer project:olimometer (critical 9.8)
- [CVE-2016-10903](https://insights.sbomify.com/CVE-2016-10903/): Cross-site request forgery in godaddy:godaddy email marketing (high 8.8)
- [CVE-2016-10902](https://insights.sbomify.com/CVE-2016-10902/): Cross-site request forgery in gowebsolutions:wp customer reviews (high 8.8)
- [CVE-2016-10901](https://insights.sbomify.com/CVE-2016-10901/): Cross-site scripting in gowebsolutions:wp customer reviews (medium 6.1)
- [CVE-2016-10900](https://insights.sbomify.com/CVE-2016-10900/): Cross-site scripting in wpmanage:uji countdown (medium 6.1)
- [CVE-2016-1090](https://insights.sbomify.com/CVE-2016-1090/): Other in adobe:acrobat (high 7.8)
- [CVE-2016-10899](https://insights.sbomify.com/CVE-2016-10899/): Missing authorization in fabrix:total security (medium 5.3)
- [CVE-2016-10898](https://insights.sbomify.com/CVE-2016-10898/): Cross-site scripting in fabrix:total security (medium 6.1)
- [CVE-2016-10897](https://insights.sbomify.com/CVE-2016-10897/): Cross-site scripting in sermon browser project:sermon browser (medium 6.1)
- [CVE-2016-10896](https://insights.sbomify.com/CVE-2016-10896/): Cross-site scripting in clogica:seo redirection (medium 6.1)
- [CVE-2016-10895](https://insights.sbomify.com/CVE-2016-10895/): Cross-site scripting in optiontree project:optiontree (medium 6.1)
- [CVE-2016-10894](https://insights.sbomify.com/CVE-2016-10894/): Security feature bypass in debian:debian linux (medium 4.6)
- [CVE-2016-10893](https://insights.sbomify.com/CVE-2016-10893/): Cross-site scripting in crayon syntax highlighter project:crayon syntax highlighter (medium 6.1)
- [CVE-2016-10892](https://insights.sbomify.com/CVE-2016-10892/): Cross-site scripting in kibokolabs:chained quiz (medium 6.1)
- [CVE-2016-10891](https://insights.sbomify.com/CVE-2016-10891/): Cross-site scripting in pojo:activity log (medium 6.1)
- [CVE-2016-10890](https://insights.sbomify.com/CVE-2016-10890/): Cross-site scripting in pojo:activity log (medium 6.1)
- [CVE-2016-1089](https://insights.sbomify.com/CVE-2016-1089/): Use after free in adobe:acrobat (critical 9.8)
- [CVE-2016-10889](https://insights.sbomify.com/CVE-2016-10889/): SQL injection in imagely:nextgen gallery (critical 9.8)
- [CVE-2016-10888](https://insights.sbomify.com/CVE-2016-10888/): SQL injection in tipsandtricks-hq:all in one wp security \& firewall (critical 9.8)
- [CVE-2016-10887](https://insights.sbomify.com/CVE-2016-10887/): SQL injection in tipsandtricks-hq:all in one wp security \& firewall (critical 9.8)
- [CVE-2016-10886](https://insights.sbomify.com/CVE-2016-10886/): Misconfiguration in benjaminrojas:wp editor (critical 9.8)
- [CVE-2016-10885](https://insights.sbomify.com/CVE-2016-10885/): Cross-site request forgery in benjaminrojas:wp editor (high 8.8)
- [CVE-2016-10884](https://insights.sbomify.com/CVE-2016-10884/): Cross-site request forgery in simple-membership-plugin:simple membership (high 8.8)
- [CVE-2016-10883](https://insights.sbomify.com/CVE-2016-10883/): Cross-site request forgery in mijnpress:simple add pages or posts (medium 6.5)
- [CVE-2016-10882](https://insights.sbomify.com/CVE-2016-10882/): Cross-site request forgery in google doc embedder project:google doc embedder (high 8.8)
- [CVE-2016-10881](https://insights.sbomify.com/CVE-2016-10881/): Cross-site scripting in google doc embedder project:google doc embedder (medium 6.1)
- [CVE-2016-10880](https://insights.sbomify.com/CVE-2016-10880/): Cross-site scripting in google doc embedder project:google doc embedder (medium 6.1)
- [CVE-2016-1088](https://insights.sbomify.com/CVE-2016-1088/): Memory corruption in adobe:acrobat (critical 9.8)
- [CVE-2016-10879](https://insights.sbomify.com/CVE-2016-10879/): Cross-site scripting in 3cx:live chat (medium 6.1)
- [CVE-2016-10878](https://insights.sbomify.com/CVE-2016-10878/): Cross-site scripting in weplugins:wp maps (medium 6.1)
- [CVE-2016-10877](https://insights.sbomify.com/CVE-2016-10877/): Cross-site scripting in wp editor project:wp editor (medium 6.1)
- [CVE-2016-10876](https://insights.sbomify.com/CVE-2016-10876/): Cross-site request forgery in wpseeds:wp database backup (high 8.8)
- [CVE-2016-10875](https://insights.sbomify.com/CVE-2016-10875/): Cross-site scripting in wpseeds:wp database backup (medium 6.1)
- [CVE-2016-10874](https://insights.sbomify.com/CVE-2016-10874/): Cross-site request forgery in wpseeds:wp database backup (high 8.8)
- [CVE-2016-10873](https://insights.sbomify.com/CVE-2016-10873/): Cross-site scripting in wpseeds:wp database backup (medium 6.1)
- [CVE-2016-10872](https://insights.sbomify.com/CVE-2016-10872/): Cross-site scripting in ultimatemember:ultimate member (medium 6.1)
- [CVE-2016-10871](https://insights.sbomify.com/CVE-2016-10871/): Cross-site scripting in ibericode:mailchimp for wordpress (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2016/page/75/