PT-2013-4445

Name of the Vulnerable Software and Affected Versions GroundWork Monitor Enterprise version 6.7.0 Description The issue concerns multiple SQL injection vulnerabilities. These vulnerabilities allow remote authenticated users to execute arbitrary SQL commands. The affected API endpoints include...

CVE-2013-3510: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in GroundWork Monitor Enterprise 6.7.0 allow remote authenticated users to execute arbitrary SQL commands via 1 nedi/html/System-Export.php, 2 nedi/html/Devices-List.php, or 3 the Noma component...

Design/Logic Flaw

export.php aka the export script in phpMyAdmin 4.x before 4.0.0-rc3 overwrites global variables on the basis of the contents of the POST superglobal array, which allows remote authenticated users to inject values via a crafted request...

CVE-2013-3241

export.php aka the export script in phpMyAdmin 4.x before 4.0.0-rc3 overwrites global variables on the basis of the contents of the POST superglobal array, which allows remote authenticated users to inject values via a crafted request...

CVE-2013-3241

CVE-2013-3241 refers to a vulnerability in phpMyAdmin 4.x prior to 4.0.0-rc3 where export.php overwrites global variables based on the POST contents, enabling remote authenticated users to inject values via crafted requests. This entry is corroborated by NVD, and related advisories describe multi...

CVE-2013-3241: Undefined Security Weakness

export.php aka the export script in phpMyAdmin 4.x before 4.0.0-rc3 overwrites global variables on the basis of the contents of the POST superglobal array, which allows remote authenticated users to inject values via a crafted request...

PT-2013-4247

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions prior to 4.0.0-rc3 Description The issue allows remote authenticated users to inject values via a crafted request, potentially leading to unauthorized access or data manipulation. This is due to the export.php script...

GD Star Rating Plugin for WordPress 'export.php' Authentication Bypass Information Disclosure

The GD Star Rating Plugin for WordPress installed on the remote host is affected by a security bypass information disclosure vulnerability. The issue is triggered when the 'plugins/gd-star-rating/export.php' script fails to properly verify user authentication, which allows a remote attacker to...

Privilege escalation in the calendar application - ownCloud

Due to not properly checking the ownership of an calendar, an authenticated attacker is able to download calendars of other users via the "calid" GET parameter to export.php in /apps/calendar/ Affected Software ownCloud Server 4.5.7 CVE-2013-0304 Action Taken It is recommended that all instances...

WordPress Advanced Custom Fields Plugin - Remote File Inclusion

WordPress Advanced Custom Fields plugin is prone to a remote file inclusion vulnerability. It allows for remote file inclusion and remote code execution via the export.php script. Solution Update the plugin...

WordPress GD Star Rating 1.9.10 SQL Injection

Exploit Title: WordPress GD Star Rating plugin 1,BENCHMARK5000000,MD5CHAR115,113,108,109,97,112,0--%20 --------------- Vulnerable code --------------- ./export.php requireonce"./code/cls/export.php"; ... if isset$GET"ex" $exporttype = $GET"ex"; ... switch$exporttype case "user":...

Directory traversal

Directory traversal vulnerability in export.php in Thyme 1.3 and earlier, when registerglobals is disabled, allows remote attackers to read arbitrary files via a .. dot dot in the exportto parameter...

CVE-2009-0535

Directory traversal vulnerability in export.php in Thyme 1.3 and earlier, when registerglobals is disabled, allows remote attackers to read arbitrary files via a .. dot dot in the exportto parameter...

CVE-2009-0535

CVE-2009-0535 describes a directory traversal in export.php of Thyme 1.3 and earlier, where, when register_globals is disabled, an attacker can read arbitrary files by supplying a .. in the export_to parameter. The NVD entry scores this as 7.5/10 (HIGH) with network access, low attack complexity,...

CVE-2009-0535: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in export.php in Thyme 1.3 and earlier, when registerglobals is disabled, allows remote attackers to read arbitrary files via a .. dot dot in the exportto parameter...

CVE-2008-5856

CVE-2008-5856 : A directory traversal vulnerability affects ClaSS prior to 0.8.61 in the scripts/export.php component. By supplying traversal sequences via the ftype parameter, a remote attacker could read arbitrary files, exposing potentially sensitive data. The public records consistently descr...

CVE-2008-5856: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in scripts/export.php in ClaSS before 0.8.61 allows remote attackers to read arbitrary files via directory traversal sequences in the ftype parameter...

ClaSS 0.8.60 - 'export.php' Local File Inclusion

ClaSS http://www.laex.org/class/ - =0.8.60 - magicquotesgpc = Off registerglobals = On - File Disclosure/Download - http://site/Class/class/scripts/export.php?ftype= /../../path/to/Class/school.php /../../path/to/Class/dbhconnect.php /../../etc/passwd - Timeline - Author notified: Dec 19 Patch...

CVE-2006-4578

export.php in The Address Book 1.04e writes username and password hash information into a publicly accessible file when dumping the MySQL database contents, which allows remote attackers to obtain sensitive information...

CVE-2006-4578

The Address Book 1.04e is affected by CVE-2006-4578 via export.php, which dumps MySQL contents and writes username and password hash information to a publicly accessible file. Root cause is the dump exposing credentials in publicly accessible storage, enabling remote attackers to obtain sensitive...