CVE-2009-1038

Multiple SQL injection vulnerabilities in YAP Blog 1.1.1 allow remote attackers to execute arbitrary SQL commands via the 1 imageid parameter to comments.php, and remote authenticated administrators to execute arbitrary SQL commands via the 2 user parameter in a modif action to admin/index.php...

CVE-2009-1038

CVE-2009-1038 concerns YAP Blog 1.1.1, which is reported to have multiple SQL injection vulnerabilities. The affected components are the (1) image_id parameter in comments.php and the (2) user parameter in a modif action to admin/index.php, potentially allowing an attacker to alter or read data v...

Pixie CMS - Cross-Site Scripting / SQL Injection

Pixie CMS Multiple Vulnerabilities Pixie is a "free, open source web application that will help you quickly create your own website. Many people refer to this type of software as a 'content management system cms'" http://www.getpixie.co.uk. Pixie is written in PHP with a MySQL database back end...

CVE-2008-6476

The CVE-2008-6476 entry refers to a Cross-site scripting (XSS) vulnerability in BlogEngine.NET . The issue affects the page blog/search.aspx where input from the q parameter can be used to inject arbitrary web script/HTML. Root cause: insufficient input sanitization on the user-controlled query p...

Yap Blog 'index.php' Remote File Include Vulnerability

Yap Blog is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied input. Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible. Versions prior to Yap Blog 1.1.1 are...

Yap Blog < 1.1.1 RFI Vulnerability - Active Check

Yap Blog is prone to a remote file inclusion RFI vulnerability because it fails to sufficiently sanitize user-supplied input. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

BLOG:CMS Cross-Site Scripting vulnerability

No description provided by source. ---------------------------------------------------------------------- PT-2009-14 Positive Technologies Security Advisory BLOG:CMS Cross-Site Scripting vulnerability ---------------------------------------------------------------------- --- Affected Software BLO...

Unfixed XSS vulnerability at www.blogitalia.it

Security researcher TheBig, has submitted on 15/03/2009 a cross-site-scripting XSS vulnerability affecting www.blogitalia.it, which at the time of submission ranked 50197 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 02/07/2009. It is current...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Mahara 1.0 before 1.0.10 and 1.1 before 1.1.2 allow remote attackers to inject arbitrary web script or HTML via a 1 profile and 2 blog, a different vulnerability than CVE-2009-0487...

Sql injection

SQL injection vulnerability in macgurublogmenu/macgurublog.php in the MacGuru BLOG Engine plugin 2.2 for e107 allows remote attackers to execute arbitrary SQL commands via the uid parameter, a different vector than CVE-2008-2455. NOTE: it was later reported that 2.1.4 is also affected...

CVE-2008-6438

SQL injection vulnerability in macgurublogmenu/macgurublog.php in the MacGuru BLOG Engine plugin 2.2 for e107 allows remote attackers to execute arbitrary SQL commands via the uid parameter, a different vector than CVE-2008-2455. NOTE: it was later reported that 2.1.4 is also affected...

CVE-2008-6438

The provided data confirms a concrete SQL injection vulnerability in the MacGuru BLOG Engine plugin for e107 (MacGuru Blog Engine). Affected component: macgurublog_menu/macgurublog.php (v2.2, with note that 2.1.4 is also affected) and, per related entries, comment.php. Root cause: unsanitized inp...

CVE-2008-6438

SQL injection vulnerability in macgurublogmenu/macgurublog.php in the MacGuru BLOG Engine plugin 2.2 for e107 allows remote attackers to execute arbitrary SQL commands via the uid parameter, a different vector than CVE-2008-2455. NOTE: it was later reported that 2.1.4 is also affected...

EZ-Blog 'public/view.php' SQL Injection Vulnerability

EZ-Blog is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying...

EZ-Blog SQLi Vulnerability (Mar 2009) - Active Check

EZ-Blog is prone to an SQL injection SQLi vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respectiv...

EZ-Blog 1b Delete All Posts / SQL Injection Vulnerabilities

Exploit for unknown platform in category web applications =========================================================== EZ-Blog 1b Delete All Posts / SQL Injection Vulnerabilities =========================================================== Salvatore "drosophila" Fresta Application: EZ-Blog...

EZ-Blog 1b Delete All Posts / SQL Injection Vulnerabilities

No description provided by source. Salvatore "drosophila" Fresta Application: EZ-Blog http://sourceforge.net/projects/ez-blog/ Version: Beta 1 Bug: Multiple SQL Injection Exploitation: Remote Date: 1 Mar 2009 Discovered by: Salvatore "drosophila" Fresta Author: Salvatore "drosophila" Fresta e-mai...

EZ-Blog Beta 1 Multiple SQL Injection

Salvatore "drosophila" Fresta Application: EZ-Blog http://sourceforge.net/projects/ez-blog/ Version: Beta 1 Bug: Multiple SQL Injection Exploitation: Remote Date: 1 Mar 2009 Discovered by: Salvatore "drosophila" Fresta Author: Salvatore "drosophila" Fresta e-mail: [email protected] - BUGS S...

EZ-Blog 1b SQL Injection

Salvatore "drosophila" Fresta Application: EZ-Blog http://sourceforge.net/projects/ez-blog/ Version: Beta 1 Bug: Multiple SQL Injection Exploitation: Remote Date: 1 Mar 2009 Discovered by: Salvatore "drosophila" Fresta Author: Salvatore "drosophila" Fresta e-mail: [email protected] - BUGS S...

EZ-Blog beta1 - Delete All Posts SQL Injection

EZ-Blog beta1 - Delete All Posts SQL Injection Salvatore "drosophila" Fresta Application: EZ-Blog http://sourceforge.net/projects/ez-blog/ Version: Beta 1 Bug: Multiple SQL Injection Exploitation: Remote Date: 1 Mar 2009 Discovered by: Salvatore "drosophila" Fresta Author: Salvatore "drosophila"...