CVE-2012-1900

CVE-2012-1900 affects RazorCMS 1.2.1 and earlier. The vulnerability is a Cross-Site Request Forgery in admin/index.php that lets remote attackers hijack an administrator’s session to perform showcats actions that delete arbitrary web pages. Root cause: CSRF in the admin interface enabling unautho...

CVE-2011-5212

SQL injection vulnerability in admin/index.php in Subrion CMS 2.0.4 allows remote attackers to execute arbitrary SQL commands via the 1 user name or 2 password field...

CVE-2011-5212: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/index.php in Subrion CMS 2.0.4 allows remote attackers to execute arbitrary SQL commands via the 1 user name or 2 password field...

CVE-2012-4231: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/index.php in jCore before 1.0pre2 allows remote attackers to inject arbitrary web script or HTML via the path parameter...

CVE-2012-1900: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in admin/index.php in RazorCMS 1.2.1 and earlier allows remote attackers to hijack the authentication of administrators for requests that delete arbitrary web pages via a showcats action...

PT-2012-3638

Name of the Vulnerable Software and Affected Versions RazorCMS versions 1.2.1 and earlier Description A cross-site request forgery issue allows remote attackers to hijack administrator authentication for requests that delete arbitrary web pages via a showcats action in the admin/index.php file...

PT-2012-5266

Name of the Vulnerable Software and Affected Versions jCore versions prior to 1.0pre2 Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands. This is achieved by manipulating the memberloginid cookie in the admin/index.php file. Recommendations For versions...

PT-2012-5265

Name of the Vulnerable Software and Affected Versions jCore versions prior to 1.0pre2 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the path parameter in the "admin/index.php" endpoint. Recommendations For versions prior to 1.0pre2...

CVE-2012-4232: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/index.php in jCore before 1.0pre2 allows remote attackers to execute arbitrary SQL commands via the memberloginid cookie...

PT-2012-2189

Name of the Vulnerable Software and Affected Versions Subrion CMS version 2.0.4 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the user name or password field in the admin/index.php file. Recommendations For Subrion CMS version 2.0.4,...

CVE-2012-5228

Cross-site scripting XSS vulnerability in admin/index.php in phplist 2.10.9, 2.10.17, and possibly other versions before 2.10.19 allows remote attackers to inject arbitrary web script or HTML via the testtarget parameter. NOTE: some of these details are obtained from third party information...

CVE-2012-5228

CVE-2012-5228 is a cross-site scripting (XSS) vulnerability in admin/index.php of phplist, affecting 2.10.9 and 2.10.17 (and possibly other versions prior to 2.10.19). The issue allows remote attackers to inject arbitrary web script or HTML via the testtarget parameter. The connected documents co...

PT-2012-5840

Name of the Vulnerable Software and Affected Versions phplist versions prior to 2.10.19 Description The issue allows remote attackers to inject arbitrary web script or HTML via the testtarget parameter in the "admin/index.php" page, potentially leading to cross-site scripting XSS attacks...

CVE-2012-5228: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/index.php in phplist 2.10.9, 2.10.17, and possibly other versions before 2.10.19 allows remote attackers to inject arbitrary web script or HTML via the testtarget parameter. NOTE: some of these details are obtained from third party information...

CVE-2012-4448

Cross-site request forgery CSRF vulnerability in wp-admin/index.php in WordPress 3.4.2 allows remote attackers to hijack the authentication of administrators for requests that modify an RSS URL via a dashboardincominglinks edit action...

PT-2012-5406

Name of the Vulnerable Software and Affected Versions WordPress version 3.4.2 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that modify an RSS URL via a dashboard incoming links edit action. This occurs in t...

CVE-2012-4448: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in wp-admin/index.php in WordPress 3.4.2 allows remote attackers to hijack the authentication of administrators for requests that modify an RSS URL via a dashboardincominglinks edit action...

Sql injection

SQL injection vulnerability in admin/index.php in phpList before 2.10.19 allows remote administrators to execute arbitrary SQL commands via the delete parameter to the editattributes page...

CVE-2012-3952

CVE-2012-3952 is an XSS vulnerability in phpList 2.10.18 and earlier, occurring in admin/index.php when the unconfirmed parameter is used (page=user). Exploitation can cause arbitrary HTML/script execution in an administrator’s browser. The related advisory confirms a fixed vendor patch: upgrade ...

CVE-2012-3952: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/index.php in phpList before 2.10.19 allows remote attackers to inject arbitrary web script or HTML via the unconfirmed parameter to the user page...