WordPress Webdorado Spider Event Calendar 1.4.9 - SQL Injection Vulnerability

Exploit for php platform in category web applications . Exploit Title: WordPress: Webdorado Spider Event Calendar = 1.4.9 SQL Injection Date: 2015-02-12 Exploit Author: Mateusz Lach Vendor Homepage: https://www.facebook.com/WebDorado or http://www.webdorado.com Software Link:...

Moodle 'calendar/externallib.php' Information Disclosure Vulnerability

Moodle is an open source web-based teaching and learning application. A security vulnerability exists in Moodle that allows an attacker to access the calendar function via a web service to obtain sensitive information...

Calendar by WD <= 1.4.9 - SQL Injection

Fixed in version confirmed by vendor in private email...

WordPress Plugin Webdorado Spider Event Calendar 1.4.9 - SQL Injection

. Exploit Title: WordPress: Webdorado Spider Event Calendar = 1.4.9 SQL Injection Date: 2015-02-12 Exploit Author: Mateusz Lach Vendor Homepage: https://www.facebook.com/WebDorado or http://www.webdorado.com Software Link: https://downloads.wordpress.org/plugin/spider-event-calendar.1.4.9.zip...

WordPress Web Dorado Spider Event Calendar Plugin 1.4.9 - SQL Injection

This Web Dorado Spider Event Calendar plugin is prone to an SQL injection. This vulnerability allows an attacker to modify data, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Upgrade the plugin...

WordPress Plugin Webdorado Spider Event Calendar 1.4.9 - SQL Injection

WordPress Plugin Webdorado Spider Event Calendar 1.4.9 - SQL Injection . Exploit Title: WordPress: Webdorado Spider Event Calendar = 1.4.9 SQL Injection Date: 2015-02-12 Exploit Author: Mateusz Lach Vendor Homepage: https://www.facebook.com/WebDorado or http://www.webdorado.com Software Link:...

Atmail Webmail 7.5 - Multiple Vulnerabilities

Atmail is a commercial Linux messaging platform provider, the company develops webmail service known as Atmail Webmail. Latest version of Atmail, including desktop and mobile versions, suffers on multiple XSS and CSRF vulnerabilities, which may lead to account takeover. Attacker is able to inject...

PHP Calendar Extension Remote Integer Overflow Vulnerability

PHP is a widely used general purpose scripting language. A remote integer overflow vulnerability exists in PHP Calendar Extension because it fails to fulfill sufficient bounds checks on user-supplied data. An attacker could exploit this vulnerability to execute arbitrary code in the context of th...

Updated moodle package fixes security vulnerabilities

Updated moodle package fixes security vulnerabilities: In Moodle before 2.6.7, absence of a capability check in AJAX backend script in the LTI module could allow any enrolled user to search the list of registered tools CVE-2015-0211. In Moodle before 2.6.7, the course summary on course request...

MGASA-2015-0032 Updated moodle package fixes security vulnerabilities

Updated moodle package fixes security vulnerabilities: In Moodle before 2.6.7, absence of a capability check in AJAX backend script in the LTI module could allow any enrolled user to search the list of registered tools CVE-2015-0211. In Moodle before 2.6.7, the course summary on course request...

CVE-2014-10015

SQL injection vulnerability in load-calendar.php in PHPJabbers Event Booking Calendar 2.0 allows remote attackers to execute arbitrary SQL commands via the cid parameter...

CVE-2014-10014

Multiple cross-site request forgery CSRF vulnerabilities in PHPJabbers Event Booking Calendar 2.0 allow remote attackers to hijack the authentication of administrators for requests that 1 change the username and password of the administrator via an update action to the AdminOptions controller or...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in PHPJabbers Event Booking Calendar 2.0 allow remote attackers to hijack the authentication of administrators for requests that 1 change the username and password of the administrator via an update action to the AdminOptions controller or...

CVE-2014-10014

Multiple cross-site request forgery CSRF vulnerabilities in PHPJabbers Event Booking Calendar 2.0 allow remote attackers to hijack the authentication of administrators for requests that 1 change the username and password of the administrator via an update action to the AdminOptions controller or...

CVE-2014-10015

CVE-2014-10015 is a SQL injection vulnerability in the PHPJabbers Event Booking Calendar 2.0, specifically in load-calendar.php where the vulnerable parameter is cid . The issue allows remote attackers to execute arbitrary SQL commands, as described across multiple sources (NVD entry and corrobor...

CVE-2014-10015

SQL injection vulnerability in load-calendar.php in PHPJabbers Event Booking Calendar 2.0 allows remote attackers to execute arbitrary SQL commands via the cid parameter...

CVE-2014-10014

This CVE concerns PHPJabbers Event Booking Calendar 2.0 with multiple CSRF vulnerabilities. The affected component paths include AdminOptions (update action that can change administrator username/password), AdminEvents (create action with event_title that can lead to XSS), and AdminCategories (cr...

PHP-Calendar 0.10.1 - Arbitrary File Inclusion

PHP-Calendar 0.10.1 - Arbitrary File Inclusion PHP-Calendar Arbitrary File Inclusion Vendor: Sean Proctor Product: PHP-Calendar Version: = 0.10.1 Website: http://php-calendar.sourceforge.net/ BID: 12127 CVE: CVE-2004-1423 OSVDB: 12700 12701 SECUNIA: 22516 PACKETSTORM: 35563 Description: I was...

PHP-Calendar < 0.10.1 - Arbitrary File Inclusion

PHP-Calendar Arbitrary File Inclusion Vendor: Sean Proctor Product: PHP-Calendar Version: = 0.10.1 Website: http://php-calendar.sourceforge.net/ BID: 12127 CVE: CVE-2004-1423 OSVDB: 12700 12701 SECUNIA: 22516 PACKETSTORM: 35563 Description: I was searching for a decent calendar which my group at...

CVE-2013-4753

Multiple cross-site scripting XSS vulnerabilities in Claroline 1.11.9 and earlier allow remote authenticated users to inject arbitrary web script or HTML via 1 the Search field in an inbox action to messaging/messagebox.php, 2 the "First name" field to auth/profile.php, or 3 the Speakers field in...