PT-2015-5277

Name of the Vulnerable Software and Affected Versions Gecko CMS versions 2.2 through 2.3 Description The issue allows remote administrators to execute arbitrary SQL commands. This is achieved via the jak delete log or ssp parameter to the "admin/index.php" endpoint. Recommendations For Gecko CMS...

PT-2015-5278

Name of the Vulnerable Software and Affected Versions Gecko CMS versions 2.2 through 2.3 Description A cross-site request forgery issue allows remote attackers to hijack administrator authentication for requests that add a new administrator user via a newuser request to "admin/index.php"...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the admin area in couponPHP before 1.2.0 allow remote administrators to inject arbitrary web script or HTML via the 1 sEcho parameter to commentspaginate.php or 2 storespaginate.php or the 3 affiliateurl, 4 description, 5 domain, 6...

PT-2015-3679

Name of the Vulnerable Software and Affected Versions couponPHP versions prior to 1.2.0 Description The issue concerns multiple cross-site scripting XSS vulnerabilities in the admin area. These vulnerabilities allow remote administrators to inject arbitrary web script or HTML via various...

CVE-2014-10035: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the admin area in couponPHP before 1.2.0 allow remote administrators to inject arbitrary web script or HTML via the 1 sEcho parameter to commentspaginate.php or 2 storespaginate.php or the 3 affiliateurl, 4 description, 5 domain, 6...

CVE-2011-5316

Cross-site request forgery CSRF vulnerability in admin/index.php in Cambio 0.5a nightly r37 allows remote attackers to hijack the authentication of administrators for requests that modify credentials via a user save action...

CVE-2011-5315

Cross-site request forgery CSRF vulnerability in admin/index.php in whCMS 0.115 alpha allows remote attackers to hijack the authentication of administrators for requests that modify credentials via a user save action...

CVE-2011-5316

Cross-site request forgery CSRF vulnerability in admin/index.php in Cambio 0.5a nightly r37 allows remote attackers to hijack the authentication of administrators for requests that modify credentials via a user save action...

CVE-2011-5316

The CVE-2011-5316 entry concerns a CSRF flaw in the Cambio 0.5a nightly r37 release, specifically affecting the admin/index.php handler. The underlying issue allows an attacker to hijack an administrator’s session and perform credential-changing actions via a seemingly legitimate user-initiated r...

PT-2015-3511

Name of the Vulnerable Software and Affected Versions whCMS version 0.115 alpha Description A cross-site request forgery issue exists, allowing remote attackers to hijack administrator authentication for requests that modify credentials via a user save action. Recommendations For whCMS version...

PT-2015-3512

Name of the Vulnerable Software and Affected Versions Cambio version 0.5a nightly r37 Description A cross-site request forgery issue exists, allowing remote attackers to hijack administrator authentication for requests that modify credentials via a user save action. This occurs in the...

CVE-2011-5315: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in admin/index.php in whCMS 0.115 alpha allows remote attackers to hijack the authentication of administrators for requests that modify credentials via a user save action...

CVE-2011-5316: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in admin/index.php in Cambio 0.5a nightly r37 allows remote attackers to hijack the authentication of administrators for requests that modify credentials via a user save action...

CVE-2014-9241

Multiple cross-site scripting XSS vulnerabilities in MyBB aka MyBulletinBoard 1.8.x before 1.8.2 allow remote attackers to inject arbitrary web script or HTML via the 1 type parameter to report.php, 2 signature parameter in a doeditsig action to usercp.php, or 3 title parameter in the...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in MyBB aka MyBulletinBoard 1.8.x before 1.8.2 allow remote attackers to inject arbitrary web script or HTML via the 1 type parameter to report.php, 2 signature parameter in a doeditsig action to usercp.php, or 3 title parameter in the...

CVE-2014-9241

Multiple cross-site scripting XSS vulnerabilities in MyBB aka MyBulletinBoard 1.8.x before 1.8.2 allow remote attackers to inject arbitrary web script or HTML via the 1 type parameter to report.php, 2 signature parameter in a doeditsig action to usercp.php, or 3 title parameter in the...

PT-2014-8896

Name of the Vulnerable Software and Affected Versions MyBB versions 1.8.x before 1.8.2 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via several parameters, including the type parameter to "report.php", the signature parameter in a "do...

CVE-2014-9241: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in MyBB aka MyBulletinBoard 1.8.x before 1.8.2 allow remote attackers to inject arbitrary web script or HTML via the 1 type parameter to report.php, 2 signature parameter in a doeditsig action to usercp.php, or 3 title parameter in the...

CVE-2014-6308

Directory traversal vulnerability in OSClass before 3.4.2 allows remote attackers to read arbitrary files via a .. dot dot in the file parameter in a render action to oc-admin/index.php...

CVE-2014-6280

Multiple cross-site scripting XSS vulnerabilities in OSClass before 3.4.2 allow remote attackers to inject arbitrary web script or HTML via the 1 action or 2 nsextt parameter to oc-admin/index.php or the 3 nsextt parameter in an itemsreported action to oc-admin/index.php...