755 matches found
CVE-2014-6308: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in OSClass before 3.4.2 allows remote attackers to read arbitrary files via a .. dot dot in the file parameter in a render action to oc-admin/index.php...
PT-2014-7129
Name of the Vulnerable Software and Affected Versions OSClass versions prior to 3.4.2 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the action or nsextt parameter to "oc-admin/index.php" or the nsextt parameter in an "items reported...
CVE-2014-6280: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in OSClass before 3.4.2 allow remote attackers to inject arbitrary web script or HTML via the 1 action or 2 nsextt parameter to oc-admin/index.php or the 3 nsextt parameter in an itemsreported action to oc-admin/index.php...
PT-2014-8453
Name of the Vulnerable Software and Affected Versions In-Portal CMS versions 5.2.0 and earlier Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the next template parameter to "admin/index.php". Recommendations For In-Portal CMS versions...
CVE-2014-8304: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in In-Portal CMS 5.2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the nexttemplate parameter to admin/index.php...
PT-2014-2359
Name of the Vulnerable Software and Affected Versions Baby Gekko versions prior to 1.2.2f Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the id parameter to "admin/index.php", or the username or password parameters in...
CVE-2012-5700: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in Baby Gekko before 1.2.2f allow remote attackers to inject arbitrary web script or HTML via the 1 id parameter to admin/index.php or the 2 username or 3 password parameter in blocks/loginbox/loginbox.template.php to index.php. NOTE: some of thes...
PT-2014-6425
Name of the Vulnerable Software and Affected Versions Disqus Comment System plugin version 2.77 Description The issue affects the Disqus Comment System plugin, allowing remote attackers to hijack the authentication of administrators. This can be achieved through multiple cross-site request forger...
CVE-2014-5346: Cross-Site Request Forgery (CSRF)
Multiple cross-site request forgery CSRF vulnerabilities in the Disqus Comment System plugin 2.77 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 activate or 2 deactivate the plugin via the active parameter to wp-admin/edit-comments.php, 3...
PT-2014-2279
Name of the Vulnerable Software and Affected Versions Microcart version 1.0 Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting XSS attacks. This can occur through various means, including the PATH INFO or query string ...
KDPics 1.18 'admin/index.php' Authentication Bypass Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/38603/info KDPics is prone to a vulnerability that lets an attacker add an administrative user because it fails to adequately secure access to administrative functionality. This may allow the attacker to compromise the...
Azeno CMS SQL Injection Vulnerability
No description provided by source. !/usr/bin/env python coding: utf-8 from pocsuite.net import req from pocsuite.poc import POCBase, Output from pocsuite.utils import register class TestPOCPOCBase: vulID = 'SSV-67893' vul ID version = '1' author = 'hzr' vulDate = '2010-03-13' createDate =...
Back-End CMS 0.4.5 admin/index.php includes_path Parameter Remote File Inclusion
No description provided by source. source: http://www.securityfocus.com/bid/20207/info Back-End CMS is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input. A successful exploit of these issues allows an attacker to execute arbitrary...
RedBLoG 0.5 admin/index.php root_path Parameter Remote File Inclusion
No description provided by source. source: http://www.securityfocus.com/bid/20115/info The redblog application is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues may allow an attacker to compromise the...
VietPHP admin/index.php language Parameter Remote File Inclusion
No description provided by source. source: http://www.securityfocus.com/bid/25226/info VietPHP is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues may allow an attacker to compromise the application and the...
Allomani Super Multimedia Library 2.5.0 - CSRF Vulnerability (Add Admin)
No description provided by source. Super Multimedia Library 2.5.0 XSRF Vulnerability Add Admin ==================================================================== .:. Author : AtT4CKxT3rR0r1ST [email protected] .:. Script : http://allomani.com/en/mediascript.html === Exploit === form method=POST...
BrudaNews <= 1.1 (admin/index.php) Remote File Include Vulnerability
No description provided by source. ============================================================================================== BrudaNews = v1.1 o Remote File Inclusion Exploit =============================================================================================== Critical Level :...
PHPFaber TopSites 3 Admin/Index.PHP Directory Traversal Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/23419/info TopSites is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable...
PT-2014-2579
Name of the Vulnerable Software and Affected Versions Batavi version 1.2.2 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the QUERY STRING to "admin/index.php". This could potentially lead to unauthorized actions on the affected...
couponPHP CMS 1.0 Multiple Stored XSS and SQL Injection Vulnerabilities
Summary couponPHP is a revolutionary content management system for running Coupon and Deal websites. It is feature rich, powerful, beautifully designed and fully automatic. Description couponPHP is vulnerable to multiple Stored XSS and SQL Injection issues. Input passed via the parameters...