PT-2011-4055

Name of the Vulnerable Software and Affected Versions Chyrp versions 2.1 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the action parameter to the default URI or includes/javascript.php, or the title or body parameter to...

CVE-2010-4630

Cross-site scripting XSS vulnerability in pages/admin/surveys/create.php in the WP Survey And Quiz Tool plugin 1.2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter...

PT-2010-5594

Name of the Vulnerable Software and Affected Versions WP Survey And Quiz Tool plugin version 1.2.1 Description A cross-site scripting issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the action parameter in the "pages/admin/surveys/create.php"...

CVE-2010-4630: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in pages/admin/surveys/create.php in the WP Survey And Quiz Tool plugin 1.2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter...

Information disclosure

The phpinfo function in SiteEngine 5.x allows remote attackers to obtain system information by setting the action parameter to phpinfo in misc.php...

PT-2010-1257

Name of the Vulnerable Software and Affected Versions SiteEngine versions 5.x Description The issue allows remote attackers to obtain system information. This is achieved by setting the action parameter to php info in the "misc.php" endpoint. Recommendations For SiteEngine versions 5.x, consider...

jSchool Advanced Cross Site Scripting

TITLE: jSchool Advanced "action" Cross-Site Scripting PRODUCT: jSchool Advanced PRODUCT URL: http://jogjacamp.com/script4jSchoolAdvanced.html RESEARCHERS: underground-stockholm.com RESEARCHERS URL: http://underground-stockholm.com/ BUG: Input passed via the "action" parameter to index.php is not...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the System Landscape Directory SLD component 6.4 through 7.02 in SAP NetWeaver allow remote attackers to inject arbitrary web script or HTML via the 1 action parameter to testsdic and the 2 helpstring parameter to paramhelp.jsp...

CVE-2010-2904: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the System Landscape Directory SLD component 6.4 through 7.02 in SAP NetWeaver allow remote attackers to inject arbitrary web script or HTML via the 1 action parameter to testsdic and the 2 helpstring parameter to paramhelp.jsp...

CVE-2010-1090: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in phpMySite allows remote attackers to execute arbitrary SQL commands via the action parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in post.aspx in Max Network Technology BBSMAX 3.0, 4.1, and 4.2 allows remote attackers to inject arbitrary web script or HTML via the action parameter...

CVE-2010-0947

Cross-site scripting XSS vulnerability in post.aspx in Max Network Technology BBSMAX 3.0, 4.1, and 4.2 allows remote attackers to inject arbitrary web script or HTML via the action parameter...

CVE-2010-0947: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in post.aspx in Max Network Technology BBSMAX 3.0, 4.1, and 4.2 allows remote attackers to inject arbitrary web script or HTML via the action parameter...

CVE-2010-0940

Cross-site scripting XSS vulnerability in guestbook.php in Simple PHP Guestbook 1.0 allows remote attackers to inject arbitrary web script or HTML via the action parameter...

CVE-2010-0940

CVE-2010-0940 is a cross-site scripting (XSS) vulnerability in Simple PHP Guestbook 1.0, exploitable via the action parameter in guestbook.php. The affected component is the guestbook submission page; the root cause is reflected/script injection in user-provided input. Expected impact, as stated ...

CVE-2010-0940: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in guestbook.php in Simple PHP Guestbook 1.0 allows remote attackers to inject arbitrary web script or HTML via the action parameter...

CVE-2009-4205: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in admin.php in Flashlight Free Edition allows remote attackers to include and execute arbitrary local files via a .. dot dot in the action parameter...

CVE-2009-3247

Cross-site scripting XSS vulnerability in the Activities module in vtiger CRM 5.0.4 allows remote attackers to inject arbitrary web script or HTML via the action parameter to phprint.php. NOTE: the querystring vector is already covered by CVE-2008-3101.3...

CVE-2009-3247: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Activities module in vtiger CRM 5.0.4 allows remote attackers to inject arbitrary web script or HTML via the action parameter to phprint.php. NOTE: the querystring vector is already covered by CVE-2008-3101.3...

CVE-2009-3053: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the Agora comagora component 3.0.0b for Joomla! allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the action parameter to the avatars page, reachable through index.php...