CVE-2017-17774

CVE-2017-17774 affects Piwigo 2.9.2, specifically the admin/configuration.php CSRF vulnerability. Root cause: cross-site request forgery in the configuration handler. Impact: could allow a remote attacker to perform unauthorized operations via forged requests if a user is authenticated, per the p...

CVE-2017-17775

Piwigo 2.9.2 is vulnerable to a cross-site scripting (XSS) flaw triggered by the name parameter in an admin.php?page=album-3-properties request. The issue affects the web-based photo gallery software as described in CVE-2017-17775; details in connected records confirm the vulnerability class and ...

CVE-2017-17775

Piwigo 2.9.2 has XSS via the name parameter in an admin.php?page=album-3-properties request...

Piwigo 'name' Parameter Cross-Site Scripting Vulnerability

Piwigo is a web-based photo album software from Piwigo team. The software supports photo publishing, management, multiple browsing category, tag, time, etc. Batch Manager component is one of the manager components. A cross-site scripting vulnerability exists in Piwigo version 2.9.2. A remote...

Piwigo SQLi Vulnerability

Piwigo is prone to SQL injection SQLi vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:piwigo:piwigo"; if...

GeoMoose <=2.9.2 /php/download.php parameter ext arbitrary file read vulnerability

No description provided by source...

GeoMoose 2.9.2 - Directory Traversal

GeoMoose 2.9.2 - Directory Traversal Exploit Title: GeoMoose = 2.9.2 Local File Disclosure Exploit Author: Sander 'dsc' Ferdinand Date: 2017-03-4 Version: = 2.9.2 Blog: https://ced.pwned.systems/advisories-geomoose-local-file-disclosure-2-9-2.html Vendor Homepage: geomoose.org Reported: 4-3-2017...

WordPress ALO EasyMail NewsLetter 2.9.2 Plugin - Cross-Site Request Forgery (Add/Import Arbitrary Su

Exploit for php platform in category web applications Cross-Site Request Forgery in ALO EasyMail Newsletter WordPress Plugin Contact For feedback or questions about this advisory mail us at sumofpwn at securify.nl The Summer of Pwnage This issue has been found during the Summer of Pwnage hacker...

CVE-2015-8241

The xmlNextChar function in libxml2 2.9.2 does not properly check the state, which allows context-dependent attackers to cause a denial of service heap-based buffer over-read and application crash or obtain sensitive information via crafted XML data...

Out-of-bounds

libxml2 2.9.2 does not properly stop parsing invalid input, which allows context-dependent attackers to cause a denial of service out-of-bounds read and libxml2 crash via crafted XML data to the 1 xmlParseEntityDecl or 2 xmlParseConditionalSections function in parser.c, as demonstrated by...

PT-2015-3257

Name of the Vulnerable Software and Affected Versions libxml2 version 2.9.2 Description The issue is caused by the xmlNextChar function in libxml2 not properly checking the state, allowing context-dependent attackers to cause a denial of service or obtain sensitive information via crafted XML dat...

PT-2015-2751

Name of the Vulnerable Software and Affected Versions libxml2 version 2.9.2 Description The issue is caused by improper handling of invalid input, allowing context-dependent attackers to cause a denial of service via crafted XML data. This can lead to an out-of-bounds read and a crash in libxml2...

[SECURITY] Fedora 20 Update: mingw-libxml2-2.9.2-1.fc20

MinGW Windows libxml2 XML processing library...

CVE-2011-0510

SQL injection vulnerability in cart.php in Advanced Webhost Billing System AWBS 2.9.2 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the oid parameter in an addother action...

CVE-2011-0508

Cross-site scripting XSS vulnerability in system/modules/comments/Comments.php in Contao CMS 2.9.2, and possibly other versions before 2.9.3, allows remote attackers to inject arbitrary web script or HTML via the HTTP XFORWARDEDFOR header, which is stored by system/libraries/Environment.php but n...

AWBS 2.9.2 Blind SQL Injection

AWBS 2.9.2 Blind SQL Injection 0day ============================================================================================= Dork....: inurl:/cart?ca=addother&oid= Date....: 01-16-2011 Author..: ShivX Contact.: shivanxatgmaildotcom Vendor..: http://www.awbs.com Link....:...

WordPress <= 2.9.2 XSS Vulnerability

Exploit for php platform in category web applications ==================================== WordPress Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 + Site : Inj3ct0r.com 0 1 + Support e-mail : submitatinj3ct0r.com 1 0 0 1 1 0 I'm TheExploited member from...

WordPress <= 2.9.2 URL Redirecting Vulnerability

Exploit for php platform in category web applications ================================================ WordPress Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 + Site : Inj3ct0r.com 0 1 + Support e-mail : submitatinj3ct0r.com 1 0 0 1 1 0 I'm TheExploited member...

WordPress &lt;= 2.9.2绕过口令保护漏洞

BUGTRAQ ID: 38876 WordPress是一款免费的论坛Blog系统。 用户可以对WordPress论坛中的每个页面或帖子设置口令，这些口令可以相同，但通过口令访问的功能设置了全站点都通用的全局Cookie，因此用户只要获得了一个对页面或帖子所设置的口令，就可以看到所有受保护的页面或帖子（在请求时会自动许可访问）。 WordPress = 2.9.2 厂商补丁： WordPress --------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://wordpress.org/...

WordPress Trashed Posts Information Disclosure Vulnerability

WordPress is prone to an information disclosure vulnerability because it fails to properly restrict access to trashed posts. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...