CVE-2011-1100: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in admin/index.php in Pixelpost 1.7.3 allow remote authenticated users to execute arbitrary SQL commands via the 1 findfid, 2 id, 3 selectfcat, 4 selectfmon, or 5 selectftag parameter in an images action...

TinyWebGallery 1.8.3 Cross Site Scripting / Directory Traversal

Date: 01/02/2011 dd/MM/yyyy Script: TinyWebGallery Version: 1.8.3 No fixes yet, might work on other versions too. Home: http://www.tinywebgallery.com -- Vulnerability: Non-persistent XSS Where: File: /admin/index.php Parameters: sview, tview, dir, item. Examples:...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in admin/managerusers.class.php in SantaFox 2.02, and possibly earlier, allows remote attackers to hijack the authentication of administrators for requests, as demonstrated by adding administrative users via the saveadmin action to admin/index.php...

CVE-2010-2516: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in 2daybiz Multi Level Marketing MLM Software allow remote attackers to execute arbitrary SQL commands via the username parameter to 1 index.php and 2 admin/index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from...

CVE-2009-4909: Improper Authentication

admin/index.php in oBlog allows remote attackers to conduct brute-force password guessing attacks via HTTP requests...

CVE-2010-2136: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in admin/index.php in Article Friendly, when magicquotesgpc is disabled, allows remote attackers to read arbitrary files via a .. dot dot in the filename parameter...

Azeno CMS SQL Injection Vulnerability

Exploit for unknown platform in category web applications ===================================== Azeno CMS SQL Injection Vulnerability ===================================== ExploiT Vulnerable File : http://127.0.0.1/admin/index.php?id=SQL ExploiT : -1 UNION SELECT 1,2,3,4,5,6,7 FROM dcuser Example...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in eTek Systems Hit Counter 2.0 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to 1 index.php, 2 inc/login.php, 3 admin/index.php, and 4 admin/forgot.php...

CVE-2010-0941: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in eTek Systems Hit Counter 2.0 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to 1 index.php, 2 inc/login.php, 3 admin/index.php, and 4 admin/forgot.php...

CVE-2009-4561

Multiple SQL injection vulnerabilities in Admin/index.php in WebLeague 2.2.0, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 username and 2 password parameters...

CVE-2009-4561: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Admin/index.php in WebLeague 2.2.0, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 username and 2 password parameters...

CVE-2009-4472: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in PHPope 1.0.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the 1 GLOBALSconfigdirplugins parameter to plugins/address/admin/index.php, 2 GLOBALSconfigdirfunctions parameter to plugins/im/compose.php, and 3...

moziloCMS Multiple Cross Site Scripting Vulnerabilities

The host is running moziloCMS and is prone to Multiple Cross Site Scripting Vulnerabilities OpenVAS Vulnerability Test $Id: gbmoziloCMSmultxssvuln.nasl 4869 2016-12-29 11:01:45Z teissa $ moziloCMS Multiple Cross Site Scripting Vulnerabilities Authors: Antu Sanadi Copyright: Copyright c 2009...

CVE-2009-4209: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in admin/index.php in moziloCMS 1.11.1 allow remote attackers to inject arbitrary web script or HTML via the 1 cat and 2 file parameters in an editsite action, different vectors than CVE-2008-6127 and CVE-2009-1367...

Bitrix Site Manager Remote File Inclusion

Author : Don Tukulesto [email protected] + Date : November 13, 2009 + Homepage : http://www.indonesiancoder.com + Vendor : http://www.bitrixsoft.com/ + Method : Remote File Inclusion + Location : INDONESIA Notes : I know this is an old bugs, but i just write this exploit under perl module...

Bitrix Site Manager Multiple Remote File Include Vulnerability

No description provided by source. + Author : Don Tukulesto [email protected] + Date : November 13, 2009 + Homepage : http://www.indonesiancoder.com + Vendor : http://www.bitrixsoft.com/ + Method : Remote File Inclusion + Location : INDONESIA Notes : I know this is an old bugs, but i just...

CVE-2009-3667

CVE-2009-3667 affects AdsDX 3.05. A SQL injection in admin/index.php via the Username parameter allows remote attackers to execute arbitrary SQL commands. Root cause: insufficient input validation/escaping enabling injection. Impact per sources: attacker could potentially access/modify data (part...

CVE-2009-3667: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/index.php in AdsDX 3.05 allows remote attackers to execute arbitrary SQL commands via the Username...

CVE-2009-3315

The affected software is NeLogic Nephp Publisher Enterprise (versions 3.5.9 and 4.5). The vulnerability is a SQL injection in admin/index.php via the Username field, caused by improper handling of input in the web application. This allows remote attackers to execute arbitrary SQL commands, with t...

CVE-2009-3315: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/index.php in NeLogic Nephp Publisher Enterprise 3.5.9 and 4.5 allows remote attackers to execute arbitrary SQL commands via the Username field...