PT-2013-4262

Name of the Vulnerable Software and Affected Versions WP Ultimate Email Marketer plugin version 1.1.0 and possibly earlier Description The issue concerns improper access restriction to certain API endpoints, specifically "list/edit.php" and "campaign/editCampaign.php", allowing remote attackers t...

Saurus CMS 4.7.1 Multiple Vulnerabilities

Saurus CMS version 4.7.1 suffers from cross site scripting, remote file inclusion, local file inclusion, information disclosure, remote SQL injection, HTTP response splitting, cross site request forgery, and directory traversal vulnerabilities. Saurus CMS 4.7.1 LFI / RFI / XSS / SQL Injection /...

Cross site scripting

Cross-site scripting XSS vulnerability in edit.php in PHP Address Book 8.2.5 allows user-assisted remote attackers to inject arbitrary web script or HTML via the Address field...

CVE-2013-1749

CVE-2013-1749: A cross-site scripting (XSS) flaw is present in edit.php of PHP Address Book 8.2.5, allowing user-assisted remote attackers to inject arbitrary script or HTML via the Address field. The issue is tied to how input in the Address field is handled, enabling script injection in context...

CVE-2013-1749: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in edit.php in PHP Address Book 8.2.5 allows user-assisted remote attackers to inject arbitrary web script or HTML via the Address field...

CVE-2013-1748: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in PHP Address Book 8.2.5 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to 1 edit.php or 2 import.php. NOTE: the view.php id vector is already covered by CVE-2008-2565.1 and the edit.php id vector is already covered by...

CVE-2013-1834: Undefined Security Weakness

notes/edit.php in Moodle 1.9.x through 1.9.19, 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allows remote authenticated users to reassign notes via a modified 1 userid or 2 courseid field...

CVE-2013-1834

notes/edit.php in Moodle 1.9.x through 1.9.19, 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allows remote authenticated users to reassign notes via a modified 1 userid or 2 courseid field...

CVE-2012-6517: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in DiY-CMS 1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 question parameter to in /modules/poll/add.php or 2 question or 3 answer parameter to modules/poll/edit.php...

TinyBrowser /tiny_mce/plugins/tinybrowser/edit.php type Parameter XSS

TinyBrowser /tinymce/plugins/tinybrowser/edit.php type Parameter XSS. Webapps exploit for php platform source: http://www.securityfocus.com/bid/57230/info TinyBrowser is prone to multiple vulnerabilities. An attacker may leverage these issues to obtain potentially sensitive information and to...

TinyBrowser - 'edit.php' Directory Listing

source: https://www.securityfocus.com/bid/57230/info TinyBrowser is prone to multiple vulnerabilities. An attacker may leverage these issues to obtain potentially sensitive information and to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site...

TinyBrowser - edit.php Directory Listing

TinyBrowser - edit.php Directory Listing source: https://www.securityfocus.com/bid/57230/info TinyBrowser is prone to multiple vulnerabilities. An attacker may leverage these issues to obtain potentially sensitive information and to execute arbitrary script code in the browser of an unsuspecting...

CVE-2012-3872

CVE-2012-3872 affects Open Constructor 3.12.0. The vulnerability is a set of reflected XSS flaws in which user-supplied input can be injected via three parameters: (1) result in data/file/edit.php, (2) q in confirm.php, and (3) keyword in users/users.php. Exploitation would allow remote attackers...

CVE-2012-3873: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Open Constructor 3.12.0 allow remote authenticated users to execute arbitrary SQL commands via the id parameter to 1 data/gallery/edit.php, 2 data/guestbook/edit.php, 3 data/file/edit.php, 4 data/htmltext/edit.php, 5 data/publication/edit.php, or 6...

CVE-2012-3872: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Open Constructor 3.12.0 allow remote attackers to inject arbitrary web script or HTML via 1 the result parameter to data/file/edit.php, 2 the q parameter to confirm.php, or 3 the keyword parameter to users/users.php...

dedecms 5.7 soft-edit.php 代码执行漏洞

No description provided by source...

[waraxe-2012-SA#089] - Multiple Vulnerabilities in TorrentTrader 2.08

waraxe-2012-SA089 - Multiple Vulnerabilities in TorrentTrader 2.08 =============================================================================== Author: Janek Vind "waraxe" Date: 17. September 2012 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-89.html Description of vulnerable...

CVE-2012-4393

Multiple cross-site request forgery CSRF vulnerabilities in ownCloud before 4.0.6 allow remote attackers to hijack the authentication of arbitrary users for requests that use 1 addBookmark.php, 2 delBookmark.php, or 3 editBookmark.php in bookmarks/ajax/; 4 calendar/delete.php, 5 calendar/edit.php...

CVE-2012-1934

Newscoop (Vendor Sourcefabric) is affected by CVE-2012-1934: an SQL injection in admin/country/edit.php through the f_country_code parameter vulnerable in Newscoop versions before 3.5.5 and 4.x before 4 RC4. The underlying issue is unsanitised input used in SQL queries, enabling an attacker to ma...

CVE-2012-1934: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/country/edit.php in Newscoop before 3.5.5 and 4.x before 4 RC4 allows remote attackers to execute arbitrary SQL commands via the fcountrycode parameter...