Cross site scripting

Cross-site scripting XSS vulnerability in index.php in ScriptsEz Ez Blog 1.0 allows remote attackers to inject arbitrary web script or HTML via the yr parameter in a bmonth action...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in admin.php in ScriptsEz Ez Blog 1.0 allow remote attackers to hijack the authentication of administrators for requests that 1 add a blog via the addblog action, 2 approve a comment via the approvecomment action, 3 change administrator...

CVE-2009-4366

ScriptsEz Ez Blog 1.0 contains a cross-site scripting (XSS) vulnerability in index.php where the yr parameter in a bmonth action can be used to inject arbitrary web script/HTML. CVE-2009-4366 has CVSSv2 base score 4.3 (Medium); attack vector: Network; authentication: None; confidentiality impact:...

CVE-2009-4365

CVE-2009-4365 describes multiple cross-site request forgery (CSRF) vulnerabilities in admin.php of ScriptsEz Ez Blog 1.0. The issue allows remote attackers to hijack administrator sessions and perform actions such as adding a blog (add_blog), approving comments (approve_comment), changing adminis...

CVE-2009-4365

Multiple cross-site request forgery CSRF vulnerabilities in admin.php in ScriptsEz Ez Blog 1.0 allow remote attackers to hijack the authentication of administrators for requests that 1 add a blog via the addblog action, 2 approve a comment via the approvecomment action, 3 change administrator...

CVE-2009-4364

Cross-site scripting XSS vulnerability in index.php in ScriptsEz Ez Blog allows remote attackers to inject arbitrary web script or HTML via the cname parameter, related to the act and id parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third...

CVE-2009-4364

CVE-2009-4364 describes a Cross-site Scripting (XSS) vulnerability in the ScriptsEz Ez Blog, affecting the application’s index.php where the cname parameter can inject arbitrary web script/HTML (related to the act and id parameters). The root cause is insufficient input validation on cname. Impac...

CVE-2009-4365: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in admin.php in ScriptsEz Ez Blog 1.0 allow remote attackers to hijack the authentication of administrators for requests that 1 add a blog via the addblog action, 2 approve a comment via the approvecomment action, 3 change administrator...

CVE-2009-4364: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in ScriptsEz Ez Blog allows remote attackers to inject arbitrary web script or HTML via the cname parameter, related to the act and id parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third...

CVE-2009-4366: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in ScriptsEz Ez Blog 1.0 allows remote attackers to inject arbitrary web script or HTML via the yr parameter in a bmonth action...

Ez Blog v1.0 (XSS/XSRF) Multiple Vulnerabilities

No description provided by source. ----------------------------------------------------------------------------------------------- Title: Ez Blog XSS/XSRF Multiple Vulnerabilities Author: Milos Zivanovic Email: milosz.securityatgmail.com Date: 15. December 2009...

Ez Blog 1.0 XSS / XSRF

----------------------------------------------------------------------------------------------- Title: Ez Blog XSS/XSRF Multiple Vulnerabilities Author: Milos Zivanovic Email: milosz.securityatgmail.com Date: 15. December 2009...

Ez Blog 1.0 - Cross-Site Scripting Cross-Site Request Forgery

Ez Blog 1.0 - Cross-Site Scripting Cross-Site Request Forgery ----------------------------------------------------------------------------------------------- Title: Ez Blog XSS/XSRF Multiple Vulnerabilities Author: Milos Zivanovic Email: milosz.securityatgmail.com Date: 15. December 2009...

Ez Blog v1.0 (XSS/XSRF) Multiple Vulnerabilities

Exploit for unknown platform in category web applications ================================================ Ez Blog v1.0 XSS/XSRF Multiple Vulnerabilities ================================================ ----------------------------------------------------------------------------------------------...

Ez Blog 1.0 - Cross-Site Scripting / Cross-Site Request Forgery

----------------------------------------------------------------------------------------------- Title: Ez Blog XSS/XSRF Multiple Vulnerabilities Author: Milos Zivanovic Email: milosz.securityatgmail.com Date: 15. December 2009...

Sql injection

SQL injection vulnerability in public/specific.php in EZ-Blog before Beta 2 20090427, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the category parameter...

CVE-2009-1626

SQL injection vulnerability in public/specific.php in EZ-Blog before Beta 2 20090427, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the category parameter...

CVE-2009-1626

SQL injection vulnerability in public/specific.php in EZ-Blog before Beta 2 20090427, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the category parameter...

CVE-2009-1626

EZ-Blog before Beta 2 20090427 is affected by an SQL injection in public/specific.php via the category parameter when magic_quotes_gpc is disabled. The underlying issue is unsanitized input leading to arbitrary SQL execution. Affected product is EZ-Blog; no vendor/patch details or specific remedi...

CVE-2009-1626: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in public/specific.php in EZ-Blog before Beta 2 20090427, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the category parameter...