Unfixed XSS vulnerability at www.thepoles.com

Security researcher cueballr, has submitted on 19/04/2008 a cross-site-scripting XSS vulnerability affecting www.thepoles.com, which at the time of submission ranked 730060 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 28/04/2008. It is...

Unfixed XSS vulnerability at www.worldemart.com

Security researcher cueballr, has submitted on 19/04/2008 a cross-site-scripting XSS vulnerability affecting www.worldemart.com, which at the time of submission ranked 360560 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 28/04/2008. It is...

Unfixed XSS vulnerability at www.liveanalsex.com

Security researcher Mystick, has submitted on 04/11/2008 a cross-site-scripting XSS vulnerability affecting www.liveanalsex.com, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 02/07/2009. It is currentl...

Unfixed XSS vulnerability at www.mymusicjob.com

Security researcher SaMTHG, has submitted on 04/07/2008 a cross-site-scripting XSS vulnerability affecting www.mymusicjob.com, which at the time of submission ranked 709062 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 08/07/2008. It is...

CVE-2008-1621

Multiple cross-site scripting XSS vulnerabilities in GeeCarts allow remote attackers to inject arbitrary web script or HTML via the id parameter to 1 show.php, 2 search.php, and 3 view.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

CVE-2008-1621: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in GeeCarts allow remote attackers to inject arbitrary web script or HTML via the id parameter to 1 show.php, 2 search.php, and 3 view.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

CVE-2008-1622: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in GeeCarts allow remote attackers to execute arbitrary PHP code via a URL in the id parameter to 1 show.php, 2 search.php, and 3 view.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

Unfixed XSS vulnerability at www.urscorp.com

Security researcher Kaospunk, has submitted on 29/03/2008 a cross-site-scripting XSS vulnerability affecting www.urscorp.com, which at the time of submission ranked 223983 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 03/04/2008. It is...

CVE-2008-1464: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Gallarific Free Edition 1.1 allow remote attackers to execute arbitrary SQL commands via the 1 query parameter to a search.php; 2 gusername and 3 gpassword parameters to b login.php; and the 4 username and 5 password parameters to c gadmin/index.php in a...

CVE-2008-1413: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in search.php in SNewsCMS Rus 2.1 through 2.4 allows remote attackers to inject arbitrary web script or HTML via the query parameter...

CVE-2008-1352

Directory traversal vulnerability in search.php in EdiorCMS ecms 3.0 allows remote attackers to read arbitrary files via a .. dot dot in the SearchTemplate parameter during a Title search...

CVE-2008-1352

Directory traversal vulnerability in search.php in EdiorCMS ecms 3.0 allows remote attackers to read arbitrary files via a .. dot dot in the SearchTemplate parameter during a Title search...

snewscmsrus-xss.txt

New Advisory: Snewscms Rus v2 http://www.medprostuda.ru --------------------Summary---------------- Software: SnewsCMS Rus v. 2.3 Sowtware's Web Site: http://www.snewscms.net.ru Versions: 2.4 Critical Level: Moderate Type: XSS Class: Remote Status: Unpatched PoC/Exploit: Not Available Solution: N...

SNewsCMS 2.x - search.php Cross-Site Scripting

SNewsCMS 2.x - search.php Cross-Site Scripting source: https://www.securityfocus.com/bid/28262/info SNewsCMS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content. An attacker may leverage this...

CVE-2008-1352: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in search.php in EdiorCMS ecms 3.0 allows remote attackers to read arbitrary files via a .. dot dot in the SearchTemplate parameter during a Title search...

new vuln in snewscms rus v 2.3

New Advisory: Snewscms Rus v2 http://www.medprostuda.ru --------------------Summary---------------- Software: SnewsCMS Rus v. 2.3 Sowtware's Web Site: http://www.snewscms.net.ru Versions: 2.4 Critical Level: Moderate Type: XSS Class: Remote Status: Unpatched PoC/Exploit: Not Available Solution: N...

CVE-2008-1326

Cross-site scripting XSS vulnerability in search.php in Gallarific allows remote attackers to inject arbitrary web script or HTML via the query parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-1326

Gallarific is affected by a Cross-site Scripting (XSS) vulnerability in search.php, exploitable via the query parameter to inject arbitrary web script/HTML. This is the explicit vulnerability described across multiple sources (including OpenVAS and NVD entries). The connected documents do not pro...

CVE-2008-1326: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in search.php in Gallarific allows remote attackers to inject arbitrary web script or HTML via the query parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-1076

CVE-2008-1076 describes a Cross-site Scripting (XSS) vulnerability in Interspire Shopping Cart 1.x, where an attacker can inject arbitrary script via the search_query parameter in search.php. The root cause is improper handling/sanitization of the search_query input, enabling script execution in ...