mhrn.ir (23.137.200.154)

United States · Lynnwood

Risk score: 100/100 · 2 open port(s) · 53 CVE(s)

First seen 2026-08-08 · last seen 2026-08-08

Open ports

Port	Service	Software	CVEs
80	http	nginx	53
443	http	nginx	0

CVEs (53)

• CVE-2009-2853 critical · CVSS 10.0 — Wordpress before 2.8.3 allows remote attackers to gain privileges via a direct request to (1) admin-footer.php, (2) edit-category-form.php,
• CVE-2011-4898 medium · CVSS 5.0 — wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacki
• CVE-2011-4899 high · CVSS 7.5 — wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database ser
• CVE-2012-0782 medium · CVSS 4.3 — Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlie
• CVE-2012-0937 medium · CVSS 5.0 — wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not limit the number of MySQL queries sent to ex
• CVE-2012-2399 critical · CVSS 10.0 — Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFupload 2.2.0.1 and earlier, as used in WordPress before 3.5.2, TinyMCE Image
• CVE-2012-2400 critical · CVSS 10.0 — Unspecified vulnerability in wp-includes/js/swfobject.js in WordPress before 3.3.2 has unknown impact and attack vectors.
• CVE-2012-2401 medium · CVSS 5.0 — Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables scripting regardless of the
• CVE-2012-2402 medium · CVSS 5.5 — wp-admin/plugins.php in WordPress before 3.3.2 allows remote authenticated site administrators to bypass intended access restrictions and de
• CVE-2012-2403 medium · CVSS 4.3 — wp-includes/formatting.php in WordPress before 3.3.2 attempts to enable clickable links inside attributes, which makes it easier for remote
• CVE-2012-2404 medium · CVSS 4.3 — wp-comments-post.php in WordPress before 3.3.2 supports offsite redirects, which makes it easier for remote attackers to conduct cross-site
• CVE-2012-1936 medium · CVSS 6.8 — The wp_create_nonce function in wp-includes/pluggable.php in WordPress 3.3.1 and earlier associates a nonce with a user account instead of a
• CVE-2011-4956 medium · CVSS 4.3 — Cross-site scripting (XSS) vulnerability in WordPress before 3.1.1 allows remote attackers to inject arbitrary web script or HTML via unspec
• CVE-2011-4957 medium · CVSS 5.0 — The make_clickable function in wp-includes/formatting.php in WordPress before 3.1.1 does not properly check URLs before passing them to the
• CVE-2012-3384 medium · CVSS 6.8 — Cross-site request forgery (CSRF) vulnerability in the customizer in WordPress before 3.4.1 allows remote attackers to hijack the authentica
• CVE-2012-3385 medium · CVSS 5.0 — WordPress before 3.4.1 does not properly restrict access to post contents such as private or draft posts, which allows remote authors or con
• CVE-2010-5106 medium · CVSS 6.5 — The XML-RPC remote publishing interface in xmlrpc.php in WordPress before 3.0.3 does not properly check capabilities, which allows remote au
• CVE-2012-4421 medium · CVSS 4.0 — The create_post function in wp-includes/class-wp-atom-server.php in WordPress before 3.4.2 does not perform a capability check, which allows
• CVE-2012-4422 low · CVSS 3.5 — wp-admin/plugins.php in WordPress before 3.4.2, when the multisite feature is enabled, does not check for network-administrator privileges b
• CVE-2013-0235 medium · CVSS 6.4 — The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct port-scanning attack
• CVE-2013-0236 medium · CVSS 4.3 — Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.1 allow remote attackers to inject arbitrary web script or HTML
• CVE-2013-0237 medium · CVSS 4.3 — Cross-site scripting (XSS) vulnerability in Plupload.as in Moxiecode plupload before 1.5.5, as used in WordPress before 3.5.1 and other prod
• CVE-2013-2199 medium · CVSS 4.3 — The HTTP API in WordPress before 3.5.2 allows remote attackers to send HTTP requests to intranet servers via unspecified vectors, related to
• CVE-2013-2200 medium · CVSS 4.0 — WordPress before 3.5.2 does not properly check the capabilities of roles, which allows remote authenticated users to bypass intended restric
• CVE-2013-2201 medium · CVSS 4.3 — Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.2 allow remote attackers to inject arbitrary web script or HTML
• CVE-2013-2202 medium · CVSS 4.3 — WordPress before 3.5.2 allows remote attackers to read arbitrary files via an oEmbed XML provider response containing an external entity dec
• CVE-2013-2203 medium · CVSS 4.3 — WordPress before 3.5.2, when the uploads directory forbids write access, allows remote attackers to obtain sensitive information via an inva
• CVE-2013-2204 medium · CVSS 4.3 — moxieplayer.as in Moxiecode moxieplayer, as used in the TinyMCE Media plugin in WordPress before 3.5.2 and other products, does not consider
• CVE-2013-2205 medium · CVSS 4.3 — The default configuration of SWFUpload in WordPress before 3.5.2 has an unrestrictive security.allowDomain setting, which allows remote atta
• CVE-2012-3414 medium · CVSS 4.3 — Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and earlier, as used in WordPress before 3.3.2, TinyMCE Image
• CVE-2010-5293 medium · CVSS 5.8 — wp-includes/comment.php in WordPress before 3.0.2 does not properly whitelist trackbacks and pingbacks in the blogroll, which allows remote
• CVE-2010-5294 medium · CVSS 4.3 — Multiple cross-site scripting (XSS) vulnerabilities in the request_filesystem_credentials function in wp-admin/includes/file.php in WordPres
• CVE-2010-5295 medium · CVSS 4.3 — Cross-site scripting (XSS) vulnerability in wp-admin/plugins.php in WordPress before 3.0.2 might allow remote attackers to inject arbitrary
• CVE-2010-5296 medium · CVSS 4.9 — wp-includes/capabilities.php in WordPress before 3.0.2, when a Multisite configuration is used, does not require the Super Admin role for th
• CVE-2010-5297 low · CVSS 2.1 — WordPress before 3.0.1, when a Multisite installation is used, permanently retains the "site administrators can add users" option once chang
• CVE-2011-5270 medium · CVSS 4.0 — wp-admin/press-this.php in WordPress before 3.0.6 does not enforce the publish_posts capability requirement, which allows remote authenticat
• CVE-2012-6633 medium · CVSS 4.3 — Cross-site scripting (XSS) vulnerability in wp-includes/default-filters.php in WordPress before 3.3.3 allows remote attackers to inject arbi
• CVE-2012-6634 medium · CVSS 6.4 — wp-admin/media-upload.php in WordPress before 3.3.3 allows remote attackers to obtain sensitive information or bypass intended media-attachm
• CVE-2012-6635 medium · CVSS 4.0 — wp-admin/includes/class-wp-posts-list-table.php in WordPress before 3.3.3 does not properly restrict excerpt-view access, which allows remot
• CVE-2014-0165 medium · CVSS 4.0 — WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related
• CVE-2014-0166 medium · CVSS 6.4 — The wp_validate_auth_cookie function in wp-includes/pluggable.php in WordPress before 3.7.2 and 3.8.x before 3.8.2 does not properly determi
• CVE-2014-5204 medium · CVSS 6.8 — wp-includes/pluggable.php in WordPress before 3.9.2 rejects invalid CSRF nonces with a different timing depending on which characters in the
• CVE-2014-5205 medium · CVSS 6.8 — wp-includes/pluggable.php in WordPress before 3.9.2 does not use delimiters during concatenation of action values and uid values in CSRF tok
• CVE-2014-5240 low · CVSS 2.1 — Cross-site scripting (XSS) vulnerability in wp-includes/pluggable.php in WordPress before 3.9.2, when Multisite is enabled, allows remote au
• CVE-2014-5265 medium · CVSS 5.0 — The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, permits entity declarat
• CVE-2014-5266 medium · CVSS 5.0 — The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, does not limit the numb
• CVE-2014-9031 medium · CVSS 4.3 — Cross-site scripting (XSS) vulnerability in the wptexturize function in WordPress before 3.7.5, 3.8.x before 3.8.5, and 3.9.x before 3.9.3 a
• CVE-2014-9034 medium · CVSS 5.0 — wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers
• CVE-2014-9035 medium · CVSS 4.3 — Cross-site scripting (XSS) vulnerability in Press This in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0
• CVE-2014-9036 medium · CVSS 4.3 — Cross-site scripting (XSS) vulnerability in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remo
• …and 3 more (see the interactive dossier)

Services

View interactive dossier