Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in admin.php in Piwigo before 2.3.4 allow remote attackers to inject arbitrary web script or HTML via the 1 section parameter in the configuration module, 2 installstatus parameter in the languagesnew module, or 3 theme parameter in the theme modu...

CVE-2012-2209

CVE-2012-2209 affects Piwigo prior to 2.3.4, exposing multiple XSS vulnerabilities in admin.php via the section, installstatus, and theme parameters. The issue enables remote attackers to inject arbitrary HTML/script in an administrator session. Vendor patch: upgrade to Piwigo 2.3.4 (remediation)...

CVE-2012-2209

Multiple cross-site scripting XSS vulnerabilities in admin.php in Piwigo before 2.3.4 allow remote attackers to inject arbitrary web script or HTML via the 1 section parameter in the configuration module, 2 installstatus parameter in the languagesnew module, or 3 theme parameter in the theme modu...

CVE-2012-2209: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in admin.php in Piwigo before 2.3.4 allow remote attackers to inject arbitrary web script or HTML via the 1 section parameter in the configuration module, 2 installstatus parameter in the languagesnew module, or 3 theme parameter in the theme modu...

PT-2012-3958

Name of the Vulnerable Software and Affected Versions Serendipity versions prior to 1.6.1 Description The issue allows remote attackers to execute arbitrary SQL commands via the serendipityplugin to conf parameter in the serendipity admin.php file. This might be related to cross-site request...

CVE-2012-4279: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Free Realty 3.1-0.6 allow remote attackers to execute arbitrary SQL commands via the 1 view parameter to agentdisplay.php or 2 edit parameter to admin/admin.php...

PT-2012-5307

Name of the Vulnerable Software and Affected Versions Free Realty versions 3.1-0.6 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the view parameter to "agentdisplay.php" or the edit parameter to "admin/admin.php". Recommendations For Fre...

Classifieds Ads Script PHP 1.1 SQL Injection

Title: ====== Classified Ads Script PHP v1.1 - SQL Injection Vulnerabilities Date: ===== 2012-06-13 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=605 VL-ID: ===== 605 Common Vulnerability Scoring System: ==================================== 5.5 Introduction:...

Event Calendar PHP 1.2 - Multiple Web Vulnerabilities

Document Title: =============== Event Calendar PHP 1.2 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=607 Release Date: ============= 2012-06-18 Vulnerability Laboratory ID VL-ID: ==================================== 607...

AdaptCMS 2.0.2 TinyURL Plugin - admin.php Multiple SQL Injections

AdaptCMS 2.0.2 TinyURL Plugin - admin.php Multiple SQL Injections source: https://www.securityfocus.com/bid/53764/info AdaptCMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues...

PBBoard v2.1.4 (CSRF) Arbitrary File Upload and Command Execution (MSF

Exploit for php platform in category web applications 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 +...

Cross site scripting

Cross-site scripting XSS vulnerability in the Share and Follow plugin 1.80.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the CDN API Key cnd-key in a share-and-follow-menu page to wp-admin/admin.php...

CVE-2012-2912

CVE-2012-2912 concerns the WordPress plugin LeagueManager (v3.7). The issue is an XSS vulnerability exploitable through parameters in the admin flow: the show-league page’s group parameter and the team page’s season parameter passed to wp-admin/admin.php. Exploitation could allow remote attackers...

CVE-2012-2912

Multiple cross-site scripting XSS vulnerabilities in the LeagueManager plugin 3.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 group parameter in the show-league page or 2 season parameter in the team page to wp-admin/admin.php...

CVE-2012-2912: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the LeagueManager plugin 3.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 group parameter in the show-league page or 2 season parameter in the team page to wp-admin/admin.php...

CVE-2012-2917: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Share and Follow plugin 1.80.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the CDN API Key cnd-key in a share-and-follow-menu page to wp-admin/admin.php...

PT-2012-4358

Name of the Vulnerable Software and Affected Versions LeagueManager plugin version 3.7 for WordPress Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the group parameter in the "show-league" page or the season parameter in the "team"...

PT-2012-4363

Name of the Vulnerable Software and Affected Versions Share and Follow plugin version 1.80.3 for WordPress Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the cnd-key variable in a share-and-follow-menu page to 'wp-admin/admin.php' A...

WordPress Plugin CataBlog 1.6 - admin.php Cross-Site Scripting

WordPress Plugin CataBlog 1.6 - admin.php Cross-Site Scripting source: https://www.securityfocus.com/bid/53520/info CataBlog plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to...

ChurchCMS 0.0.1 SQL Injection

Exploit Title: ChurchCMS 0.0.1 'admin.php' Multiple SQLi Date: 04/21/12 Author: G13 Twitter: @g13net Software Link: http://sourceforge.net/projects/churchcms/?source=directory Version: 0.0.1 Category: webapps php Description ChurchCMS is the software to place on your church's website that is easi...