PT-2011-5075

Name of the Vulnerable Software and Affected Versions Parallels Plesk Panel version 10.3.1 build1013110726.09 Description The issue concerns multiple cross-site scripting XSS vulnerabilities in the billing system. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML...

PT-2011-4989

Name of the Vulnerable Software and Affected Versions Phorum version 5.2.18 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved by manipulating the PATH INFO to admin/index.php. Recommendations For Phorum version...

CVE-2010-5051

Cross-site scripting XSS vulnerability in admin/core/adminfunc.php in razorCMS 1.0 stable allows remote attackers to inject arbitrary web script or HTML via the content parameter in an edit action to admin/index.php...

PT-2011-1986

Name of the Vulnerable Software and Affected Versions razorCMS version 1.0 stable Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the content parameter in an edit action to...

CVE-2010-4749: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in BLOG:CMS 4.2.1.e, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the 1 body parameter to action.php and the 2 amount and 3 action parameters to admin/index.php...

PT-2011-1699

Name of the Vulnerable Software and Affected Versions BLOG:CMS versions 4.2.1.e and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the body parameter to "action.php" and the amount and action parameters to "admin/index.php"...

Sql injection

Multiple SQL injection vulnerabilities in admin/index.php in Pixelpost 1.7.3 allow remote authenticated users to execute arbitrary SQL commands via the 1 findfid, 2 id, 3 selectfcat, 4 selectfmon, or 5 selectftag parameter in an images action...

CVE-2011-1100

Multiple SQL injection vulnerabilities in admin/index.php in Pixelpost 1.7.3 allow remote authenticated users to execute arbitrary SQL commands via the 1 findfid, 2 id, 3 selectfcat, 4 selectfmon, or 5 selectftag parameter in an images action...

PT-2011-2865

Name of the Vulnerable Software and Affected Versions Pixelpost version 1.7.3 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved through SQL injection vulnerabilities in the admin/index.php file, specifically via the findfid, id, selectfcat...

CVE-2011-1100: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in admin/index.php in Pixelpost 1.7.3 allow remote authenticated users to execute arbitrary SQL commands via the 1 findfid, 2 id, 3 selectfcat, 4 selectfmon, or 5 selectftag parameter in an images action...

TinyWebGallery 1.8.3 Cross Site Scripting / Directory Traversal

Date: 01/02/2011 dd/MM/yyyy Script: TinyWebGallery Version: 1.8.3 No fixes yet, might work on other versions too. Home: http://www.tinywebgallery.com -- Vulnerability: Non-persistent XSS Where: File: /admin/index.php Parameters: sview, tview, dir, item. Examples:...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in admin/managerusers.class.php in SantaFox 2.02, and possibly earlier, allows remote attackers to hijack the authentication of administrators for requests, as demonstrated by adding administrative users via the saveadmin action to admin/index.php...

CVE-2010-2516: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in 2daybiz Multi Level Marketing MLM Software allow remote attackers to execute arbitrary SQL commands via the username parameter to 1 index.php and 2 admin/index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from...

CVE-2009-4909: Improper Authentication

admin/index.php in oBlog allows remote attackers to conduct brute-force password guessing attacks via HTTP requests...

CVE-2010-2136: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in admin/index.php in Article Friendly, when magicquotesgpc is disabled, allows remote attackers to read arbitrary files via a .. dot dot in the filename parameter...

Azeno CMS SQL Injection Vulnerability

Exploit for unknown platform in category web applications ===================================== Azeno CMS SQL Injection Vulnerability ===================================== ExploiT Vulnerable File : http://127.0.0.1/admin/index.php?id=SQL ExploiT : -1 UNION SELECT 1,2,3,4,5,6,7 FROM dcuser Example...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in eTek Systems Hit Counter 2.0 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to 1 index.php, 2 inc/login.php, 3 admin/index.php, and 4 admin/forgot.php...

CVE-2010-0941: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in eTek Systems Hit Counter 2.0 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to 1 index.php, 2 inc/login.php, 3 admin/index.php, and 4 admin/forgot.php...

CVE-2009-4561

Multiple SQL injection vulnerabilities in Admin/index.php in WebLeague 2.2.0, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 username and 2 password parameters...

CVE-2009-4561: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Admin/index.php in WebLeague 2.2.0, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 username and 2 password parameters...