Code execution vulnerability in xdcms

xdcms is a fully open source and general purpose content management system. A code execution vulnerability exists in xdcms. The vulnerability is due to the background configuration page fails to completely filter the content submitted by the administrator due to the attacker can be exploited to...

CVE-2018-12431

SeaCMS V6.61 has XSS via the site name parameter on an adm1n/adminconfig.php page aka a system management page...

Piwigo Configuration Component Cross-Site Scripting Vulnerability

Piwigo is a set of web-based photo album software from the Piwigo team. The software supports photo publishing, management, multiple browsing categories, tags, time, etc. Configuration component is a component for configuration. A cross-site scripting vulnerability exists in the Configuration...

CVE-2017-17823

The Configuration component of Piwigo 2.9.2 is vulnerable to SQL Injection via the admin/configuration.php orderby array parameter. An attacker can exploit this to gain access to the data in a connected MySQL database...

Sql injection

The Configuration component of Piwigo 2.9.2 is vulnerable to SQL Injection via the admin/configuration.php orderby array parameter. An attacker can exploit this to gain access to the data in a connected MySQL database...

CVE-2017-17774

admin/configuration.php in Piwigo 2.9.2 has CSRF...

CVE-2017-17774

admin/configuration.php in Piwigo 2.9.2 has CSRF...

Piwigo admin/configuration.php file cross-site request forgery vulnerability

Piwigo is a web-based photo album software from Piwigo team. The software supports photo publishing, management, multiple browsing category, tag, time, etc. Batch Manager component is one of the manager components. A cross-site request forgery vulnerability exists in the admin/configuration.php...

EyesOfNetwork web interface cross-site scripting vulnerability (CNVD-2017-33355)

EyesOfNetwork "EON" is an open source solution that combines practical ITIL processes with a technical interface that allows its workday program. A cross-site scripting vulnerability exists in the EyesOfNetwork web interface, which allows a remote authenticated user to inject arbitrary web script...

samba: pam_winbind fails open when non-existent group specified to require_membership_of

The winbindnamelisttosidstringlist function in nsswitch/pamwinbind.c in Samba through 4.1.2 handles invalid requiremembershipof group names by accepting authentication by any user, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by...

CVE-2012-4771

Multiple cross-site scripting XSS vulnerabilities in Subrion CMS before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the id parameter to 1 admin/accounts/, 2 admin/manage/, or 3 admin/manage/blocks/edit/; or 4 group parameter to admin/configuration/. NOTE: The...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Subrion CMS before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the id parameter to 1 admin/accounts/, 2 admin/manage/, or 3 admin/manage/blocks/edit/; or 4 group parameter to admin/configuration/. NOTE: The...

CVE-2011-5159

Cross-site scripting XSS vulnerability in admin/configuration.php in Geeklog before 1.7.1sr1 allows remote attackers to inject arbitrary web script or HTML via the subgroup parameter, a different vulnerability than CVE-2011-4942...

CVE-2011-5159

Cross-site scripting XSS vulnerability in admin/configuration.php in Geeklog before 1.7.1sr1 allows remote attackers to inject arbitrary web script or HTML via the subgroup parameter, a different vulnerability than CVE-2011-4942...

Softbiz SEO FAQ CSRF Vulnerability

Exploit for php platform in category web applications Exploit Title: Softbiz SEO FAQ CSRF Author: Jonturk75 Vendor or Software Link: http://www.scripts.com/viewscript/softbiz-seo-faq-software/32336/ Category:: webapps Demo : http://demos1.softbiz.com/scripts/seofaq/admin/ Greetz: Inj3ct0r Exploit...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in VaM Shop 1.6, 1.6.1, and probably earlier versions llow remote attackers to inject arbitrary web script or HTML via the 1 status parameter to admin/orders.php, 2 search parameter to admin/customers.php, or 3 STORENAME parameter to...

PenPals - Authentication Bypass

Author: L0rd CrusAd3r aka VSN [email protected] Exploit Title: PenPals Authentication Bypass Vendor url:http://www.anblik.com Version:1.0 Price:1200$ Published: 2010-06-17 Greetz to:Sid3^effects, MaYur, M4n0j, Dark Blue, S1ayer,d3c0d3r,KD and to all ICW members. Spl Greetz to:inj3ct0r.com Tea...

gpEasy 1.6.1 Cross Site Request Forgery

============================================= gpEasy Date : 04-29-2010 Site : http://www.giudinvx.altervista.org/ Location : Naples, Italy -------------------------------------------------------- Application Info Site : http://www.gpeasy.com/ Version: 1.6.1...

CVE-2008-7124: Improper Authentication

zKup CMS 2.0 through 2.3 does not require administrative authentication for admin/configuration/modifier.php, which allows remote attackers to gain administrator privileges via a direct request, as demonstrated by adding a new administrator...

CVE-2008-7123: Improper Control of Generation of Code

Static code injection vulnerability in admin/configuration/modifier.php in zKup CMS 2.0 through 2.3 allows remote attackers to inject arbitrary PHP code into fichiers/config.php via a null byte %00 in the login parameter in an ajout action, which bypasses the regular expression check...