The Dbox 3D Slider Lite plugin through 1.2.2 for WordPress has SQL Injection via settingssliders.php (current_slider_id parameter).

The Smooth Slider plugin through 2.8.6 for WordPress has SQL Injection via smooth-slider.php (trid parameter).

The Testimonial Slider plugin through 1.2.4 for WordPress has SQL Injection via settingssliders.php (current_slider_id parameter).

diag_ping.cmd on D-Link DSL-2640U devices with firmware IM_1.00 and ME_1.00, and DSL-2540U devices with firmware ME_1.00, allows authenticated remote attackers to execute arbitrary OS commands via shell metacharacters in the ipaddr field of an HTTP GET request.

BizLogic xnami 1.0 has XSS via the comment parameter in an addComment action to the /media/ajax URI.

The SrbTransLatin plugin 1.46 for WordPress has XSS via an srbtranslatoptions action to wp-admin/options-general.php with a lang_identificator parameter.