CVE-2012-6430

Cross-site scripting XSS vulnerability in Open Solution Quick.Cms 5.0 and Quick.Cart 6.0, possibly as downloaded before December 19, 2012, allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to admin.php. NOTE: this might be a duplicate of CVE-2008-4140...

Cross site scripting

Cross-site scripting XSS vulnerability in Open Solution Quick.Cms 5.0 and Quick.Cart 6.0, possibly as downloaded before December 19, 2012, allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to admin.php. NOTE: this might be a duplicate of CVE-2008-4140...

CVE-2012-6430

Cross-site scripting XSS vulnerability in Open Solution Quick.Cms 5.0 and Quick.Cart 6.0, possibly as downloaded before December 19, 2012, allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to admin.php. NOTE: this might be a duplicate of CVE-2008-4140...

CVE-2012-6430

Cross-site scripting XSS vulnerability in Open Solution Quick.Cms 5.0 and Quick.Cart 6.0, possibly as downloaded before December 19, 2012, allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to admin.php. NOTE: this might be a duplicate of CVE-2008-4140...

CVE-2012-6430

The CVE-2012-6430 entry describes a Cross-Site Scripting (XSS) vulnerability in OpenSolution Quick.Cms 5.0 and Quick.Cart 6.0 (and possibly earlier) where unsafely processed data in PATH_INFO to admin.php allows remote attackers to execute arbitrary scripts. The issue originates from insufficient...

CVE-2013-1408: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the Wysija Newsletters plugin before 2.2.1 for WordPress allow remote authenticated administrators to execute arbitrary SQL commands via the 1 search or 2 orderby parameter to wp-admin/admin.php. NOTE: this can be leveraged using CSRF to allow remote...

CVE-2012-6430: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Open Solution Quick.Cms 5.0 and Quick.Cart 6.0, possibly as downloaded before December 19, 2012, allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to admin.php. NOTE: this might be a duplicate of CVE-2008-4140...

PT-2014-2475

Name of the Vulnerable Software and Affected Versions Wysija Newsletters plugin versions prior to 2.2.1 Description The issue allows remote authenticated administrators to execute arbitrary SQL commands via the search or orderby parameter to "wp-admin/admin.php". This can be leveraged using CSRF ...

Debian: Security Advisory (DSA-2882-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Cross site scripting

Cross-site scripting XSS vulnerability in Kasseler CMS before 2 r1232 allows remote authenticated users with permissions to create categories to inject arbitrary web script or HTML via the cat parameter in an adminnewcategory action to admin.php...

CVE-2013-3728

CVE-2013-3728 affects Kasseler CMS prior to 2 r1232. The connected sources document three vulnerabilities in Kasseler CMS: stored XSS via the cat parameter in admin.php (admin_new_category action), general XSS, and CSRF allowing SQL execution. Specifically, remote authenticated users with categor...

CVE-2013-3728: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Kasseler CMS before 2 r1232 allows remote authenticated users with permissions to create categories to inject arbitrary web script or HTML via the cat parameter in an adminnewcategory action to admin.php...

CVE-2013-3727: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Kasseler CMS before 2 r1232 allows remote authenticated users to execute arbitrary SQL commands via the groups parameter to admin.php. NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands...

CVE-2013-3729: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in Kasseler CMS before 2 r1232 allow remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the 1 groups parameter in a send action in the sendmail module or 2 query parameter in ...

PT-2014-2705

Name of the Vulnerable Software and Affected Versions Kasseler CMS versions prior to 2 r1232 Description The issue allows remote authenticated users to execute arbitrary SQL commands via the groups parameter to "admin.php". This can be leveraged using CSRF to allow remote unauthenticated attacker...

PT-2014-2706

Name of the Vulnerable Software and Affected Versions Kasseler CMS versions prior to 2 r1232 Description The issue allows remote authenticated users with permissions to create categories to inject arbitrary web script or HTML via the cat parameter in an "admin new category" action to "admin.php"...

PT-2014-2707

Name of the Vulnerable Software and Affected Versions Kasseler CMS versions prior to 2 r1232 Description The issue allows remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks. This can be achieved via the groups parameter in a send action...

OpenSupports Remote Shell Upload Vulnerability

Sites powered by OpenSupports suffer from a remote shell upload vulnerability. Exploit Title: Open Support Arbitrary Remote File Upload Vulnerabilities Google Dork: allintext: "Power by OpenSupports © 2009 - 2014. All Rights reserved" Date: 02,March 02,2014 Exploit Author: Slotleet Vendor Homepag...

Singapore 0.9.9b / 0.9.10 Cross Site Scripting

Author: TUNISIAN CYBER + Exploit Title: singapore v0.9.9b/0.9.10 admin.php POST Cross Site Scripting Vulnerability + Date: 05-02-2014 + Category: WebApp + Google Dork: : + Tested on: KaliLinux + Vendor: http://sourceforge.net/projects/singapore/ + Friendly Sites: na3il.com,th3-creative.com...

PT-2014-2506

Name of the Vulnerable Software and Affected Versions LeagueManager plugin versions prior to 3.8.1 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the league id parameter in the "leaguemanager-export" page to "wp-admin/admin.php"...