PYSEC-2014-16

Cross-site scripting XSS vulnerability in cgi/client.py in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the @action parameter to support/issue1...

CVE-2012-6131

Cross-site scripting XSS vulnerability in cgi/client.py in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the @action parameter to support/issue1...

CVE-2014-2092

Cross-site scripting XSS vulnerability in lib/filemanager/ImageManager/editorFrame.php in CMS Made Simple 1.11.10 allows remote attackers to inject arbitrary web script or HTML via the action parameter, a different issue than CVE-2014-0334. NOTE: the original disclosure also reported issues that...

Apache Struts 2 'action:' Parameter Prefix Security Constraint Bypass

The remote web application appears to use Struts 2, a web framework used for creating Java web applications. The version of Struts 2 in use is affected by a security constraint bypass vulnerability due to a flaw in the action mapping mechanism. Under certain unspecified conditions, an attacker...

DEBIAN-CVE-2013-0332

Multiple directory traversal vulnerabilities in ZoneMinder 1.24.x before 1.24.4 allow remote attackers to read arbitrary files via a .. dot dot in the 1 view, 2 request, or 3 action parameter...

Spree controller Parameter Arbitrary Ruby Object Instantiation Command Execution

Spree Commerce 1.0.x before 2.0.0.rc1 allows remote authenticated administrators to instantiate arbitrary Ruby objects and executd arbitrary commands via the 1 paymentmethod parameter to core/app/controllers/spree/admin/ paymentmethodscontroller.rb; and the 2 promotionaction parameter to...

CVE-2011-5182

Cross-site scripting XSS vulnerability in lanoba-social-plugin/index.php in the Lanoba Social plugin 1.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter. NOTE: the vendor disputes this issue, stating "Lanoba's plug in does sanitize user input,...

PT-2012-2159 · WordPress +1 · Wordpress +1

Name of the Vulnerable Software and Affected Versions: Lanoba Social plugin version 1.0 Description: A cross-site scripting XSS issue in the Lanoba Social plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter in lanoba-social-plugin/index.php...

CVE-2012-3805

Multiple cross-site scripting XSS vulnerabilities in the getAllPassedParams function in system/functions.php in Kajona before 3.4.2 allow remote attackers to inject arbitrary web script or HTML via the 1 absendername, 2 absenderemail, or 3 absendernachricht parameter to the content page; 4...

EUVD-2011-2719

Directory traversal vulnerability in Chyrp 2.1 and earlier allows remote attackers to include and execute arbitrary local files via a ..%2F encoded dot dot slash in the action parameter to the default URI...

CVE-2010-4630

Cross-site scripting XSS vulnerability in pages/admin/surveys/create.php in the WP Survey And Quiz Tool plugin 1.2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter...

Information disclosure

The phpinfo function in SiteEngine 5.x allows remote attackers to obtain system information by setting the action parameter to phpinfo in misc.php...

jSchool Advanced Cross Site Scripting

TITLE: jSchool Advanced "action" Cross-Site Scripting PRODUCT: jSchool Advanced PRODUCT URL: http://jogjacamp.com/script4jSchoolAdvanced.html RESEARCHERS: underground-stockholm.com RESEARCHERS URL: http://underground-stockholm.com/ BUG: Input passed via the "action" parameter to index.php is not...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the System Landscape Directory SLD component 6.4 through 7.02 in SAP NetWeaver allow remote attackers to inject arbitrary web script or HTML via the 1 action parameter to testsdic and the 2 helpstring parameter to paramhelp.jsp...

Cross site scripting

Cross-site scripting XSS vulnerability in post.aspx in Max Network Technology BBSMAX 3.0, 4.1, and 4.2 allows remote attackers to inject arbitrary web script or HTML via the action parameter...

CVE-2010-0947

Cross-site scripting XSS vulnerability in post.aspx in Max Network Technology BBSMAX 3.0, 4.1, and 4.2 allows remote attackers to inject arbitrary web script or HTML via the action parameter...

CVE-2010-0940

Cross-site scripting XSS vulnerability in guestbook.php in Simple PHP Guestbook 1.0 allows remote attackers to inject arbitrary web script or HTML via the action parameter...

CVE-2010-0940

CVE-2010-0940 is a cross-site scripting (XSS) vulnerability in Simple PHP Guestbook 1.0, exploitable via the action parameter in guestbook.php. The affected component is the guestbook submission page; the root cause is reflected/script injection in user-provided input. Expected impact, as stated ...

CVE-2009-3247

Cross-site scripting XSS vulnerability in the Activities module in vtiger CRM 5.0.4 allows remote attackers to inject arbitrary web script or HTML via the action parameter to phprint.php. NOTE: the querystring vector is already covered by CVE-2008-3101.3...

CVE-2009-2145

Multiple cross-site scripting XSS vulnerabilities in transLucid 1.75 allow remote attackers to inject arbitrary web script or HTML via the a NodeID and b action parameters to the default URI, and the c NodeID parameter to the default URI for the admin section; and allow remote authenticated users...