1654 matches found
CVE-2010-4280
Multiple SQL injection vulnerabilities in Pandora FMS before 3.1.1 allow remote authenticated users to execute arbitrary SQL commands via 1 the idgroup parameter in an operation/agentes/veragente action to ajax.php or 2 the groupid parameter in an operation/agentes/estadoagente action to index.ph...
CVE-2010-4280
Multiple SQL injection vulnerabilities in Pandora FMS before 3.1.1 allow remote authenticated users to execute arbitrary SQL commands via 1 the idgroup parameter in an operation/agentes/veragente action to ajax.php or 2 the groupid parameter in an operation/agentes/estadoagente action to index.ph...
CVE-2010-4281
CVE-2010-4281 describes an incomplete blacklist vulnerability in Pandora FMS prior to 3.1.1. The issue lies in the safe_url_extraclean function used by ajax.php (parameter page); it filters the colon character but fails to prevent UNC paths, allowing an attacker to reference remote resources (e.g...
Cross site scripting
Cross-site scripting XSS vulnerability in ajax.php in Wiccle Web Builder WWB 1.00 and 1.0.1 allows remote attackers to inject arbitrary web script or HTML via the posttext parameter in a site customsearch action to index.php. NOTE: some of these details are obtained from third party information...
CVE-2010-3208
CVE-2010-3208 is an XSS vulnerability in the Wiccle Web Builder (WWB) web application. The affected components are the PHP file path involved, specifically in the ajax.php handling for WWB versions 1.00 and 1.0.1. The root cause is a cross-site scripting flaw that allows an attacker to inject arb...
CVE-2010-3208
Cross-site scripting XSS vulnerability in ajax.php in Wiccle Web Builder WWB 1.00 and 1.0.1 allows remote attackers to inject arbitrary web script or HTML via the posttext parameter in a site customsearch action to index.php. NOTE: some of these details are obtained from third party information...
Discuz7. X registration code to extract the XSS cross-site vulnerabilities-vulnerability warning-the black bar safety net
Vulnerability file: ajax.php Code reading: $message = "span id="seccodeswf".$ secchecktype.""& gt;/span". extensionloaded"ming" ? "script type="text/javascript" reload="1"\n$"seccodeswf$secchecktype". innerHTML=ACFLRunContent "width", "$seccodedatawidth", "height", "$seccodedataheight", "src",...
CVE-2010-0614
SQL injection vulnerability in ajax.php in evalSMSI 2.1.03 allows remote attackers to execute arbitrary SQL commands via the query parameter in the 1 question action, and possibly the 2 subpar or 3 numquest actions...
Sql injection
SQL injection vulnerability in ajax.php in evalSMSI 2.1.03 allows remote attackers to execute arbitrary SQL commands via the query parameter in the 1 question action, and possibly the 2 subpar or 3 numquest actions...
CVE-2010-0614
CVE-2010-0614 is a SQL injection in evalSMSI 2.1.03 affecting ajax.php. The vulnerability allows remote attackers to inject SQL through the query parameter in the (1) question action and potentially (2) sub_par or (3) num_quest actions. Documents confirm the affected product/version and the input...
CVE-2010-0617
CVE-2010-0617 affects evalSMSI, specifically version 2.1.03, with a cross-site scripting (XSS) flaw in ajax.php that allows injection of arbitrary script/HTML via the return parameter. The vulnerability is cited in multiple feeds (NVD entry, OpenVAS findings) and has a NVD base score of 4.3 (Medi...
CVE-2010-0617
Cross-site scripting XSS vulnerability in ajax.php in evalSMSI 2.1.03 allows remote attackers to inject arbitrary web script or HTML via the return parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...
CORELAN-10-008 - Multiple vulnerabilities found in evalmsi 2.1.03
|------------------------------------------------------------------| | | | / / / / | | / / / / / / / / / / / | | / // // / / / / / // / / / / / // / // / / / / / / | | /// //,// // //,// // // | | | | http://www.corelan.be:8800 | | [email protected] | | |...
DokuWiki ajax.php cmd[del] Parameter Security Bypass
The remote web server is hosting a version of DokuWiki that is affected by a security bypass vulnerability in the 'cmddel', parameter of the 'lib/plugins/acl/ajax.php' script. An attacker, exploiting this flaw, could modify modify the ACL settings for a specified user or group. Note that this...
WordPress <2.2 wp-admin-admin-ajax.php SQL注入漏洞
No description provided by source...
CVE-2008-6077
SQL injection vulnerability in loudblog/ajax.php in LoudBlog 0.8.0a and earlier allows remote authenticated users to execute arbitrary SQL commands via the colpick parameter in a singleread action...
CVE-2008-6077
This CVE (CVE-2008-6077) affects LoudBlog versions up to 0.8.0a, where the vulnerability is in loudblog/ajax.php. The underlying issue is an SQL injection in the singleread action, exploitable via the colpick parameter, allowing remote authenticated users to execute arbitrary SQL commands. The pr...
OpenHelpDesk 1.0.100 - 'eval()' Code Execution (Metasploit)
$Id: phpeval.rb 5783 2008-10-23 02:43:21Z ramon $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...
Sql injection
SQL injection vulnerability in ajax.php in Gregarius 0.5.4 and earlier allows remote attackers to execute arbitrary SQL commands via the rsargs array parameter in an expgetFeedContent action...