Joomla! Component com_cbcontact - 'contact_id' SQL Injection

source: https://www.securityfocus.com/bid/47856/info The 'comcbcontact' component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the...

HTB22980: XSRF (CSRF) in Open Classifieds

Vulnerability ID: HTB22980 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinopenclassifieds.html Product: Open Classifieds Vendor: Open Classifieds Team http://www.open-classifieds.com/ Vulnerable Version: 1.7.1.1 and probably prior versions Vendor Notification: 28 April 2011 Vulnerability...

Calendarix 0.8.20080808 - Multiple Cross-Site Scripting / SQL Injections

source: https://www.securityfocus.com/bid/47790/info Calendarix is prone to multiple cross-site scripting vulnerabilities and an SQL-injection vulnerability because the application fails to sufficiently sanitize user-supplied input. Exploiting these issues could allow an attacker to steal...

e107 0.7.25 - news.php SQL Injection

e107 0.7.25 - news.php SQL Injection source: https://www.securityfocus.com/bid/47750/info e107 is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the...

VCalendar 1.1.5 - Cross-Site Request Forgery

VCalendar 1.1.5 - Cross-Site Request Forgery Vulnerability ID: HTB22969 Reference: http://www.htbridge.ch/advisory/csrfcrosssiterequestforgeryinvcalendar.html Product: VCalendar Vendor: UltraApps http://ultraapps.com Vulnerable Version: 1.1.5 Vendor Notification: 21 April 2011 Vulnerability Type:...

PHP Directory Listing Script 3.1 Cross Site Scripting

Vulnerability ID: HTB22968 Reference: http://www.htbridge.ch/advisory/xssinphpdirectorylistingscript.html Product: PHP Directory Listing Script Vendor: http://www.evoluted.net http://www.evoluted.net Vulnerable Version: 3.1 Vendor Notification: 21 April 2011 Vulnerability Type: XSS Cross Site...

Daily Maui Photo Widget WordPress Plugin 0.2 Cross Site Scripting

Vulnerability ID: HTB22960 Reference: http://www.htbridge.ch/advisory/xssindailymauiphotowidgetwordpressplugin.html Product: Daily Maui Photo Widget wordpress plugin Vendor: Kris Nelson http://www.webnelly.com/ Vulnerable Version: 0.2 Vendor Notification: 14 April 2011 Vulnerability Type: XSS Cro...

Noah's Classifieds 5.0.4 Cross Site Scripting

Vulnerability ID: HTB22952 Reference: http://www.htbridge.ch/advisory/xssvulnerabilitiesinnoahsclassifieds.html Product: Noah's Classifieds Vendor: Noah's Classifieds http://www.noahsclassifieds.org/ Vulnerable Version: 5.0.4 and probably prior versions Vendor Notification: 12 April 2011...

SyCtel Design - menu Multiple Local File Inclusions

SyCtel Design - menu Multiple Local File Inclusions source: https://www.securityfocus.com/bid/47526/info SyCtel Design is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can exploit these vulnerabilities to obtain...

LightNEasy 3.2.3 - userhandle Cookie SQL Injection

LightNEasy 3.2.3 - userhandle Cookie SQL Injection source: https://www.securityfocus.com/bid/47541/info LightNEasy is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker...

LightNEasy 3.2.3 - 'userhandle' Cookie SQL Injection

source: https://www.securityfocus.com/bid/47541/info LightNEasy is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify...

SocialGrid WordPress Plugin 2.3 Cross Site Scripting

Vulnerability ID: HTB22940 Reference: http://www.htbridge.ch/advisory/xssinsocialgridwordpressplugin.html Product: SocialGrid wordpress plugin Vendor: Michael Whalen http://whalesalad.com Vulnerable Version: 2.3 Vendor Notification: 05 April 2011 Vulnerability Type: XSS Cross Site Scripting Risk...

RunCMS Module Partners - id SQL Injection

RunCMS Module Partners - id SQL Injection source: https://www.securityfocus.com/bid/47388/info The RunCMS 'partners' module is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an...

Dimac CMS 1.3 XS - default.asp SQL Injection

Dimac CMS 1.3 XS - default.asp SQL Injection source: https://www.securityfocus.com/bid/47291/info Dimac CMS XS is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an...

Etki Video PRO 2.0 - 'izle.asp?id' SQL Injection

source: https://www.securityfocus.com/bid/47298/info Etki Video Pro is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to compromise the application...

vTiger CRM 5.2.1 - sortfieldsjson.php Local File Inclusion

vTiger CRM 5.2.1 - sortfieldsjson.php Local File Inclusion source: https://www.securityfocus.com/bid/47263/info vtiger CRM is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability to obtain potentially...

PrestaShop 1.3.6 - 'cms.php' Remote File Inclusion

source: https://www.securityfocus.com/bid/47264/info PrestaShop is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied input. Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are als...

vTiger CRM 5.2.1 - 'sortfieldsjson.php' Local File Inclusion

source: https://www.securityfocus.com/bid/47263/info vtiger CRM is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability to obtain potentially sensitive information and execute arbitrary local scripts in t...

HTB22911: XSS in Eleanor CMS

Vulnerability ID: HTB22911 Reference: http://www.htbridge.ch/advisory/xssineleanorcms.html Product: Eleanor CMS Vendor: Eleanor CMS http://eleanor-cms.ru/ Vulnerable Version: rc5 Vendor Notification: 22 March 2011 Vulnerability Type: XSS Cross Site Scripting Status: Fixed by Vendor Risk level:...

UseBB 1.0.11 - 'admin.php' Local File Inclusion

source: https://www.securityfocus.com/bid/47166/info UseBB is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability to obtain potentially sensitive information and execute arbitrary local scripts in the...