PT-2012-2189

Name of the Vulnerable Software and Affected Versions Subrion CMS version 2.0.4 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the user name or password field in the admin/index.php file. Recommendations For Subrion CMS version 2.0.4,...

CVE-2012-4232: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/index.php in jCore before 1.0pre2 allows remote attackers to execute arbitrary SQL commands via the memberloginid cookie...

CVE-2012-1900: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in admin/index.php in RazorCMS 1.2.1 and earlier allows remote attackers to hijack the authentication of administrators for requests that delete arbitrary web pages via a showcats action...

PT-2012-5266

Name of the Vulnerable Software and Affected Versions jCore versions prior to 1.0pre2 Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands. This is achieved by manipulating the memberloginid cookie in the admin/index.php file. Recommendations For versions...

CVE-2011-5212: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/index.php in Subrion CMS 2.0.4 allows remote attackers to execute arbitrary SQL commands via the 1 user name or 2 password field...

PT-2012-5265

Name of the Vulnerable Software and Affected Versions jCore versions prior to 1.0pre2 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the path parameter in the "admin/index.php" endpoint. Recommendations For versions prior to 1.0pre2...

CVE-2012-4231: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/index.php in jCore before 1.0pre2 allows remote attackers to inject arbitrary web script or HTML via the path parameter...

CVE-2012-5228

Cross-site scripting XSS vulnerability in admin/index.php in phplist 2.10.9, 2.10.17, and possibly other versions before 2.10.19 allows remote attackers to inject arbitrary web script or HTML via the testtarget parameter. NOTE: some of these details are obtained from third party information...

CVE-2012-5228

CVE-2012-5228 is a cross-site scripting (XSS) vulnerability in admin/index.php of phplist, affecting 2.10.9 and 2.10.17 (and possibly other versions prior to 2.10.19). The issue allows remote attackers to inject arbitrary web script or HTML via the testtarget parameter. The connected documents co...

CVE-2012-5228: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/index.php in phplist 2.10.9, 2.10.17, and possibly other versions before 2.10.19 allows remote attackers to inject arbitrary web script or HTML via the testtarget parameter. NOTE: some of these details are obtained from third party information...

PT-2012-5840

Name of the Vulnerable Software and Affected Versions phplist versions prior to 2.10.19 Description The issue allows remote attackers to inject arbitrary web script or HTML via the testtarget parameter in the "admin/index.php" page, potentially leading to cross-site scripting XSS attacks...

CVE-2012-4448

Cross-site request forgery CSRF vulnerability in wp-admin/index.php in WordPress 3.4.2 allows remote attackers to hijack the authentication of administrators for requests that modify an RSS URL via a dashboardincominglinks edit action...

PT-2012-5406

Name of the Vulnerable Software and Affected Versions WordPress version 3.4.2 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that modify an RSS URL via a dashboard incoming links edit action. This occurs in t...

CVE-2012-4448: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in wp-admin/index.php in WordPress 3.4.2 allows remote attackers to hijack the authentication of administrators for requests that modify an RSS URL via a dashboardincominglinks edit action...

Sql injection

SQL injection vulnerability in admin/index.php in phpList before 2.10.19 allows remote administrators to execute arbitrary SQL commands via the delete parameter to the editattributes page...

CVE-2012-3952: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/index.php in phpList before 2.10.19 allows remote attackers to inject arbitrary web script or HTML via the unconfirmed parameter to the user page...

PT-2012-5083

Name of the Vulnerable Software and Affected Versions phplist versions prior to 2.10.19 Description The issue allows remote administrators to execute arbitrary SQL commands. This is achieved via the delete parameter to the 'editattributes' page in 'admin/index.php'. Recommendations For versions...

CVE-2012-4247: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote attackers to inject arbitrary web script or HTML via the 1 remoteuser, 2 remotedatabase, 3 remoteuserprefix, 4 remotepassword, or 5 remoteprefix parameter to the import4 page; or the ...

CVE-2012-4246: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote attackers to inject arbitrary web script or HTML via the 1 page parameter; or the 2 footer, 3 status, or 4 testtarget parameter in the send page...

CVE-2012-3953: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/index.php in phpList before 2.10.19 allows remote administrators to execute arbitrary SQL commands via the delete parameter to the editattributes page...