1991 matches found
CVE-2010-0614: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in ajax.php in evalSMSI 2.1.03 allows remote attackers to execute arbitrary SQL commands via the query parameter in the 1 question action, and possibly the 2 subpar or 3 numquest actions...
CVE-2010-0606: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in scp/ajax.php in osTicket before 1.6.0 Stable allows remote authenticated users to inject arbitrary web script or HTML via the f parameter, possibly related to an error message generated by scp/admin.php...
CVE-2010-0617: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in ajax.php in evalSMSI 2.1.03 allows remote attackers to inject arbitrary web script or HTML via the return parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...
CVE-2010-0605: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in scp/ajax.php in osTicket before 1.6.0 Stable allows remote authenticated users, with "Staff" permissions, to execute arbitrary SQL commands via the input parameter...
CORELAN-10-008 - Multiple vulnerabilities found in evalmsi 2.1.03
|------------------------------------------------------------------| | | | / / / / | | / / / / / / / / / / / | | / // // / / / / / // / / / / / // / // / / / / / / | | /// //,// // //,// // // | | | | http://www.corelan.be:8800 | | [email protected] | | |...
DokuWiki ajax.php cmd[del] Parameter Security Bypass
The remote web server is hosting a version of DokuWiki that is affected by a security bypass vulnerability in the 'cmddel', parameter of the 'lib/plugins/acl/ajax.php' script. An attacker, exploiting this flaw, could modify modify the ACL settings for a specified user or group. Note that this...
WordPress <2.2 wp-admin-admin-ajax.php SQL注入漏洞
No description provided by source...
CVE-2008-7242: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in MODx CMS 0.9.6.1 and 0.9.6.1p1 allo remote attackers to inject arbitrary web script or HTML via the 1 search, 2 "a," 3 messagesubject, and 4 messagebody parameters to certain pages as reachable from manager/index.php; 5 highlight, 6 id, 7 email...
CVE-2008-6077
SQL injection vulnerability in loudblog/ajax.php in LoudBlog 0.8.0a and earlier allows remote authenticated users to execute arbitrary SQL commands via the colpick parameter in a singleread action...
CVE-2008-6077
This CVE (CVE-2008-6077) affects LoudBlog versions up to 0.8.0a, where the vulnerability is in loudblog/ajax.php. The underlying issue is an SQL injection in the singleread action, exploitable via the colpick parameter, allowing remote authenticated users to execute arbitrary SQL commands. The pr...
CVE-2008-6077: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in loudblog/ajax.php in LoudBlog 0.8.0a and earlier allows remote authenticated users to execute arbitrary SQL commands via the colpick parameter in a singleread action...
OpenHelpDesk 1.0.100 - 'eval()' Code Execution (Metasploit)
$Id: phpeval.rb 5783 2008-10-23 02:43:21Z ramon $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...
Sql injection
SQL injection vulnerability in ajax.php in Gregarius 0.5.4 and earlier allows remote attackers to execute arbitrary SQL commands via the rsargs array parameter in an expgetFeedContent action...
CVE-2008-3374
SQL injection vulnerability in ajax.php in Gregarius 0.5.4 and earlier allows remote attackers to execute arbitrary SQL commands via the rsargs array parameter in an expgetFeedContent action...
CVE-2008-3374
CVE-2008-3374 afects Gregarius up to version 0.5.4: an SQL injection in ajax.php via the rsargs array in the __exp__getFeedContent action. This allows an unauthenticated, remote attacker to manipulate database queries in the application and potentially disclose data. The vulnerability is triggere...
CVE-2008-3374: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in ajax.php in Gregarius 0.5.4 and earlier allows remote attackers to execute arbitrary SQL commands via the rsargs array parameter in an expgetFeedContent action...
Gregarius <= 0.5.4 rsargs[] Remote SQL Injection Vulnerability
No description provided by source. GulfTech Security Research July 29, 2008 Vendor : Marco Bonetti URL : http://www.gregarius.net/ Version : Gregarius = 0.5.4 Risk : SQL Injection Description: Gregarius is a popular web-based RSS/RDF/ATOM feed aggregator written in php. There are some SQL Injecti...
CVE-2008-2976
Multiple directory traversal vulnerabilities in TinX/cms 1.1, when registerglobals is enabled, allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the 1 language parameter to a includeme.php, b admin/ajax.php, and c...
CVE-2008-0094: Improper Limitation of a Pathname to a Restricted Directory
Multiple directory traversal vulnerabilities in MODx Content Management System 0.9.6.1 allow remote attackers to 1 include and execute arbitrary local files via a .. dot dot in the aslanguage parameter to assets/snippets/AjaxSearch/AjaxSearch.php, reached through index-ajax.php; and 2 read...
[waraxe-2007-SA#050] - Sql Injection in WordPress 2.1.3
waraxe-2007-SA050 - Sql Injection in WordPress 2.1.3 ==================================================================== Author: Janek Vind "waraxe" Date: 21. May 2007 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-50.html Target software description: Vulnerable: WordPress 2.1.3...