Cross-Site Scripting (XSS)

craftcms/cms is susceptible to cross-site scripting XSS attacks. These attacks exist because the application displays the first name, last name and user name on the user index and user edit pages without properly encoding them...

Ignite Realtime Openfire Elevation of Privilege Vulnerability

Ignite Realtime Openfire formerly known as Wildfire is the IgniteRealtime community of a Java development and based on XMPP formerly known as Jabber, Instant Messaging Protocol cross-platform open-source real-time collaboration RTC server , it can build a high-efficiency instant messaging servers...

Code injection

Ignite Realtime Openfire 3.10.2 allows remote authenticated users to gain administrator access via the isadmin parameter to user-edit-form.jsp...

Suning a backstage bypass arbitrary file upload-vulnerability warning-the black bar safety net

http://58.213.19.68/users/signin Suning Plaza phone the client back-end management system http://58.213.19.68/users/signup you can register for an account Then login ! Snip2015010713. png Point into the background is not entitled to limit access, but the system using rb to develop The error...

CFME: check_privileges logic error resulting in privilege escalation

The checkprivileges method in vmdb/app/controllers/applicationcontroller.rb in ManageIQ, as used in Red Hat CloudForms Management Engine CFME, allows remote authenticated users to bypass authorization and gain privileges by leveraging improper RBAC checking, related to the rbacuseredit action...

SyndeoCMS <= 3.0.01 Persistent XSS Vulnerability

Exploit for php platform in category web applications +---------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : SyndeoCMS = 3.0.01 Persistent XSS Date : 29-03-2012 Author : Ivano Binetti...

AChecker 1.2 - Multiple Error-Based SQL Injection Vulnerabilities

AChecker 1.2 - Multiple Error-Based SQL Injection Vulnerabilities AChecker 1.2 Multiple Error-Based SQL Injection vulnerabilities Vendor: ATutor Inclusive Design Institute Product web page: http://www.atutor.ca Affected version: 1.2 build r530 Summary: AChecker is an open source Web accessibility...

Pandora FMS 3.2.1 Cross Site Request Forgery

Exploit Title: Pandora FMS v3.2.1 Cross Site Request Forgery Google Dork: intitle:"Pandora FMS - the Flexible Monitoring System" intext:"Your IP" Date: 12-07-2011 Author: Mehdi Boukazoula Software Link: http://pandorafms.org/ Version: v 3.2.1 Tested on: v = Pandora XSRF exploit Click submit input...

Wordpress core 3.1.3 Persistent XSS Vulnerability

No description provided by source. Title: Wordpress core 3.1.3 self-XSS Author: Jelmer de Hen Software link: http://wordpress.org/download/Version: 3.1.3 Wordpress 3.1.3 has a self-XSS vulnerability in the following pages:/wp-admin/user-edit.php?userid=uid/wp-admin/profile.php By putting Javascri...

PHP Planner 0.4 Cross Site Request Forgery

Title: phpplanner = PHP Planner v.0.4 Multiple Vulnerabilities Date: 13/05/10 Author: cp77fk4r | empty0pageSHIFT+2gmail.com | www.DigitalWhisper.co.il Software Link: http://phpplanner.sourceforge.net/ Version: = v.0.4 Tested on: PHP Full Path Disclosure Full Path Disclosure FPD vulnerabilities...

CakeCMS Cross Site Request Forgery

Application Name : CakeCMS Vulnerable Type : Edıt USER XSRF Vuln author : MnmL Bug Researchers User Name : E-Mail :...

CVE-2008-3325

Cross-site request forgery CSRF vulnerability in Moodle 1.6.x before 1.6.7 and 1.7.x before 1.7.5 allows remote attackers to modify profile settings and gain privileges as other users via a link or IMG tag to the user edit profile page...

CVE-2005-4613

Technical details for CVE-2005-4613 are not publicly available in the provided documents; the materials include only a general description of an XSS issue in VUBB alpha rc1. Monitor for updates.

DUware DUforum 3.03.1 - userEdit.asp?id SQL Injection

DUware DUforum 3.03.1 - userEdit.asp?id SQL Injection source: https://www.securityfocus.com/bid/14035/info DUforum is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in SQL queries. A successful exploit could...