20526 matches found
CVE-2011-5139
CVE-2011-5139 describes an SQL injection in the Pre Studio Business Cards Designer, specifically in the page.php file, where the vulnerable parameter is the id parameter. The vulnerability enables remote attackers to execute arbitrary SQL commands via that parameter. The NVD entry lists a base sc...
CVE-2011-5150
Multiple cross-site scripting XSS vulnerabilities in SpamTitan 5.07 and possibly earlier allow remote attackers or authenticated users to inject arbitrary web script or HTML via the 1 ipaddress or 2 domain parameter to setup-network.php, different vectors than CVE-2011-5149. NOTE: the provenance ...
CVE-2011-5143
CVE-2011-5143 — Multiple XSS vulnerabilities in Open Business Management (OBM) 2.3.20 and earlier allow remote attackers to inject arbitrary script/HTML via index.php parameters tf_name, tf_delegation, and tf_ip. The OpenVAS entry for Open Business Management
CVE-2011-5138
The CVE‑2011‑5138 entry describes a cross‑site scripting (XSS) vulnerability in tForum b0.915, specifically in member.php under the viewprofile action where the username parameter can inject arbitrary web script/HTML. Affected component: tForum (version b0.915); vulnerability type: XSS. Root caus...
CVE-2011-5150
CVE-2011-5150 describes multiple XSS vulnerabilities in SpamTitan 5.07 and possibly earlier. The issue allows remote attackers or authenticated users to inject arbitrary JavaScript/HTML via the (1) ipaddress or (2) domain parameter to setup-network.php, representing a different vector from CVE-20...
CVE-2011-5148
Multiple incomplete blacklist vulnerabilities in the Simple File Upload modsimplefileuploadv1.3 module before 1.3.5 for Joomla! allow remote attackers to execute arbitrary code by uploading a file with a 1 php5, 2 php6, or 3 double e.g. .php.jpg extension, then accessing it via a direct request t...
CVE-2011-5137
CVE-2011-5137 relates to multiple SQL injection vulnerabilities in tForum b0.915. The affected components are the scripts viewtopic.php, viewboard.php, and viewcat.php, which accept the TopicID, BoardID, and CatID parameters respectively. The underlying issue is improper sanitization leading to S...
CVE-2011-5148
CVE-2011-5148 affects Joomla! Simple File Upload (mod_simplefileuploadv1.3) prior to 1.3.5. The module’s incomplete blacklist allows remote attackers to upload files with a PHP5/ PHP6 or double extension (e.g., .php.jpg) and then access the file in images/ to achieve remote code execution. Exploi...
CVE-2011-5132
Cross-site scripting XSS vulnerability in MyBB before 1.6.5 allows remote attackers to inject arbitrary web script or HTML via vectors related to "usernames via AJAX."...
CVE-2011-5130
dev/less.php in Family Connections CMS FCMS 2.5.0 - 2.7.1, when registerglobals is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in the argv1 parameter...
CVE-2011-5130
CVE-2011-5130 affects Family Connections CMS (FCMS) versions 2.5.0–2.7.1. The issue lives in dev/less.php and arises when register_globals is on, allowing remote attackers to execute arbitrary commands via shell metacharacters in argv[1]. Root cause reported as insecure use of system(), enabling ...
CVE-2011-5135
CVE-2011-5135 affects DoceboLMS prior to or including 4.0.4, in the save_connection function (lib/lib.iotask.php) of the iotask module. The vulnerability allows remote authenticated users with admin or teacher privileges to execute arbitrary SQL commands via the parameters coursereportuiconfig[na...
CVE-2011-5129
CVE-2011-5129 affects XChat 2.8.9 and earlier, with a heap-based buffer overflow caused by insufficient bounds checking in processing a long response string. Impact described as remote denial of service (crash) and potentially arbitrary code execution. Several connected advisories confirm the sam...
CVE-2011-1398
CVE-2011-1398 affects PHP’s SAPI handling: the sapi_header_op function in main/SAPI.c does not check for %0D (carriage return) sequences, allowing HTTP response-splitting bypass via crafted URLs. Affected versions are PHP before 5.3.11 and 5.4.x before 5.4.0RC2. The issue is described in multiple...
CVE-2011-5134
CVE-2011-5134 describes an unrestricted file upload vulnerability in the Joomla! JCE editor component (editor/extensions/browser/file.php) prior to version 2.0.18. The issue allows remote authenticated users with author privileges to upload a file with a double extension (e.g., .php.gif) and ther...
CVE-2011-5136
showImg.php in EPractize Labs Subscription Manager, possibly 1.0, allows remote attackers to overwrite arbitrary files via the db parameter...
CVE-2011-5132
MyBB
CVE-2011-5136
The CVE affects showImg.php in EPractize Labs Subscription Manager (likely version 1.0). A remote attacker can overwrite arbitrary files via the db parameter, indicating a file-write risk due to unsafely handled input. The publicly available description confirms impact as arbitrary file overwrite...
CVE-2011-5131
Summary: CVE-2011-5131 is a CSRF vulnerability in MyBB’s global.php prior to 1.6.5 that allows an attacker to hijack a user’s session to change the language setting via the language parameter. Affected software: MyBB