CVE-2017-17774

admin/configuration.php in Piwigo 2.9.2 has CSRF...

CVE-2017-17774

admin/configuration.php in Piwigo 2.9.2 has CSRF...

CVE-2017-17774

admin/configuration.php in Piwigo 2.9.2 has CSRF...

CVE-2017-17774: Cross-Site Request Forgery (CSRF)

admin/configuration.php in Piwigo 2.9.2 has CSRF...

PT-2017-14991

Name of the Vulnerable Software and Affected Versions Piwigo version 2.9.2 Description The issue affects the admin/configuration.php file in Piwigo, where a CSRF Cross-Site Request Forgery weakness is present. Recommendations For Piwigo version 2.9.2, consider implementing CSRF protection...

Joomla! 3.4.6-3.4.x 目录遍历漏洞

本地包含： http://www.site.com/components/comdocman/dl2.php?archive=0&file=LDF 先通过本地包含漏洞查看物理路径，然后在configuration.php 数据库配置文件中，使用base64目录遍历payload 如： http://www.site.com/components/comdocman/dl2.php?archive=0&file=Li4vLi4vLi4vLi4vLi4vLi4vLi4vdGFyZ2V0L3d3dy9jb25maWd1cmF0aW9uLnBocA==...

Joomla Fsave 2.0 Local File Disclosure

. | | / | | \ \ | | \ / | |\ / / /\ \ / \ | Y / ^ / / || / / / / /\ /\ \ \ \ | / \ / / \ | \ \ / // / \ / / / / Joomla = fsave Plugin Local File Disclosure Vulnerability My + Author : KnocKout Contact : [email protected] Skype : [email protected] HomePage : http://milw00rm.com -...

Elxis CMS 2009.2 - Remote file include vulnerbility

No description provided by source. \ \ \ / / / \ / / / |// / / // // / / / // // / // // / // // / //|| priasantai.uni.cc | team-elite.us elxis2009.2electrarev2631 === multiple Remote File Include Author : n0n0x Homepage: http://priasantai.uni.cc/ Download script :...

Design/Logic Flaw

Mambo CMS 4.6.5 uses world-readable permissions on configuration.php, which allows local users to obtain the admin password hash by reading the file...

CVE-2013-2563

Mambo CMS 4.6.5 uses world-readable permissions on configuration.php, which allows local users to obtain the admin password hash by reading the file...

CVE-2013-2563

CVE-2013-2563 affects Mambo CMS 4.6.5. The issue is world-readable permissions on configuration.php, enabling local users to read the admin password hash. The connected documents confirm the affected product and the root cause, but do not provide a remediation or exploit details. Action: monitor ...

PT-2014-2592

Name of the Vulnerable Software and Affected Versions Mambo CMS version 4.6.5 Description The issue allows local users to obtain the admin password hash by reading the configuration.php file due to world-readable permissions. Recommendations For Mambo CMS version 4.6.5, change the permissions of...

CVE-2013-2563: Undefined Security Weakness

Mambo CMS 4.6.5 uses world-readable permissions on configuration.php, which allows local users to obtain the admin password hash by reading the file...

Cuppa CMS - alertConfigField.php LocalRemote File Inclusion

Cuppa CMS - alertConfigField.php LocalRemote File Inclusion Exploit Title : Cuppa CMS File Inclusion Date : 4 June 2013 Exploit Author : CWH Underground Site : www.2600.in.th Vendor Homepage : http://www.cuppacms.com/ Software Link : http://jaist.dl.sourceforge.net/project/cuppacms/cuppacms.zip...

PT-2012-3242

Name of the Vulnerable Software and Affected Versions SocialCMS version 1.0.2 Description The issue concerns multiple cross-site request forgery CSRF vulnerabilities. These vulnerabilities allow remote attackers to hijack the authentication of administrators for specific requests. The requests in...

Cross site scripting

Cross-site scripting XSS vulnerability in admin/configuration.php in Geeklog before 1.7.1sr1 allows remote attackers to inject arbitrary web script or HTML via the subgroup parameter, a different vulnerability than CVE-2011-4942...

CVE-2011-4942

Geekslog’s admin/configuration.php is affected by XSS in multiple inputs (1) subgroup and (2) conf_group in Geeklog before 1.7.1sr1. The root cause is insufficient input sanitization allowing remote attackers to inject arbitrary HTML/script. Impact is limited to web context and requires user-orig...

CVE-2011-5159

GeSleeklog (Geeklog) vulnerability in admin/configuration.php before 1.7.1sr1 allows remote XSS via the sub_group parameter. The issue is a distinct variant from CVE-2011-4942 and arises in the subgroup parameter handling, potentially enabling script insertion. Redhat/NVD entries confirm similar ...

CVE-2011-5159

Cross-site scripting XSS vulnerability in admin/configuration.php in Geeklog before 1.7.1sr1 allows remote attackers to inject arbitrary web script or HTML via the subgroup parameter, a different vulnerability than CVE-2011-4942...

CVE-2011-4942: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in admin/configuration.php in Geeklog before 1.7.1sr1 allow remote attackers to inject arbitrary web script or HTML via the 1 subgroup or 2 confgroup parameters. NOTE: this vulnerability might require a user-assisted attack or a bypass of a CSRF...