CVE-2016-7902

Unrestricted file upload vulnerability in the fileUnzip-unzip method in Dotclear before 2.10.3 allows remote authenticated users with permissions to manage media items to execute arbitrary code by uploading a ZIP file containing a file with a crafted extension, as demonstrated by .php.txt or...

CVE-2016-7902

Unrestricted file upload vulnerability in the fileUnzip-unzip method in Dotclear before 2.10.3 allows remote authenticated users with permissions to manage media items to execute arbitrary code by uploading a ZIP file containing a file with a crafted extension, as demonstrated by .php.txt or...

Server side request forgery (ssrf)

CuteFlow 2.10.3 and 2.11.0c does not properly restrict access to pages/edituser.php, which allows remote attackers to modify usernames and passwords via a direct request...

Cuteflow 2.10.3 edituser.php Security Bypass Vulnerability

No description provided by source. It's possible edit the users including the admin account, bypassing the authentication through the address: http://localhost/cuteflow/pages/edituser.php?userid=1&language=pt&sortby=st rLastName&sortdir=ASC&start=1 The vulnerability is caused due to the applicati...

Cuteflow 2.10.3 - edituser.php Security Bypass

Cuteflow 2.10.3 - edituser.php Security Bypass It's possible edit the users including the admin account, bypassing the authentication through the address: http://localhost/cuteflow/pages/edituser.php?userid=1&language=pt&sortby=st rLastName&sortdir=ASC&start=1 The vulnerability is caused due to t...

Cuteflow 2.10.3 - 'edituser.php' Security Bypass

It's possible edit the users including the admin account, bypassing the authentication through the address: http://localhost/cuteflow/pages/edituser.php?userid=1&language=pt&sortby=st rLastName&sortdir=ASC&start=1 The vulnerability is caused due to the application not properly restricting access ...

CVE-2006-5321

Multiple cross-site scripting XSS vulnerabilities in phplist before 2.10.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2006-5321

Multiple cross-site scripting XSS vulnerabilities in phplist before 2.10.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2006-5294

Cross-site scripting XSS vulnerability in index.php in phplist before 2.10.3 allows remote attackers to inject arbitrary web script or HTML via the unsubscribeemail parameter...

phpList 2.x - Public Pages MultipleCross-Site Scripting Vulnerabilities

phpList 2.x - Public Pages MultipleCross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/20483/info phpList is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to have...