Invision Power Board 1.x?2.x3.x - Admin Takeover

Invision Power Board 1.x?2.x3.x - Admin Takeover IPB Invision Power Board all versions 1.x? / 2.x / 3.x Admin account Takeover leading to code execution Written on : 2013/05/02 Released on : 2013/05/13 Author: John JEAN @johnjean on twitter Affected application: Invision Power Board = 3.4.4 Type ...

CVE-2013-3538

Multiple cross-site scripting XSS vulnerabilities in todooforum.php in Todoo Forum 2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 idpost or 2 pg parameter...

CVE-2013-3537

Multiple SQL injection vulnerabilities in todooforum.php in Todoo Forum 2.0 allow remote attackers to execute arbitrary SQL commands via the 1 idpost or 2 pg parameter...

Sql injection

Multiple SQL injection vulnerabilities in todooforum.php in Todoo Forum 2.0 allow remote attackers to execute arbitrary SQL commands via the 1 idpost or 2 pg parameter...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in todooforum.php in Todoo Forum 2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 idpost or 2 pg parameter...

CVE-2013-3537

Multiple SQL injection vulnerabilities in todooforum.php in Todoo Forum 2.0 allow remote attackers to execute arbitrary SQL commands via the 1 idpost or 2 pg parameter...

CVE-2013-3538

Multiple cross-site scripting XSS vulnerabilities in todooforum.php in Todoo Forum 2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 idpost or 2 pg parameter...

CVE-2013-3537

CVE-2013-3537 affects Todoo Forum 2.0 (todooforum.php). The vulnerability is multiple SQL injection via the id_post or pg parameters, enabling remote SQL command execution. Root cause: improper input handling allows injection. Impact: potential data disclosure/modification, depending on the DB. C...

CVE-2013-3538

CVE-2013-3538 describes multiple XSS vulnerabilities in Todoo Forum 2.0, specifically in the file todooforum.php via parameters (1) id_post or (2) pg. The NVD entry notes a MEDIUM severity (CVSS2 base score 4.3) with user interaction not required and partial integrity impact. Connected records co...

CVE-2013-3537: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in todooforum.php in Todoo Forum 2.0 allow remote attackers to execute arbitrary SQL commands via the 1 idpost or 2 pg parameter...

PT-2013-4468

Name of the Vulnerable Software and Affected Versions Todoo Forum version 2.0 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the id post or pg parameters in the todooforum.ph...

PT-2013-4467

Name of the Vulnerable Software and Affected Versions Todoo Forum version 2.0 Description The issue concerns SQL injection vulnerabilities in the todooforum.php file. Remote attackers can execute arbitrary SQL commands by manipulating the id post or pg parameters. Recommendations For Todoo Forum...

CVE-2013-3538: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in todooforum.php in Todoo Forum 2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 idpost or 2 pg parameter...

jeecms官方论坛逻辑与定向xss

简要描述： 逻辑错误。外加N个 XSS跨站 详细说明： http://bbs.jeecms.com 登陆了以后有一个积分。在积分兑换的时候。出现了逻辑错误。我没太仔细看代码。应为你们论坛不停的弹窗。烦 附送一个xss指定用户的漏洞 漏洞证明： img src="https://images.seebug.org/upload/201305/09152003d9c607aeef924ed9219cee8c64cc742d.jpg" alt="4.jpg" width="...

Gbbs micro Forum v3. 1. 4 injection vulnerability-vulnerability warning-the black bar safety net

Official address: http://www.softatm.com Vulnerability to prove:/css/ss.txt Program download: http://down.chinaz.com/soft/33484.htm Vulnerability files /userinfo. asp 7 2 row 7 row 4 Vulnerability type: character type injection Vulnerability information: p%yhm = request"yhm" set rs=server...

Discuz! X2.5 521交友插件 7.3 jiaoyou.php SQL注入漏洞

Discuz!是国内一款非常流行的论坛程序，其第三方插件521交友 7.3版本存在SQL注入漏洞，攻击者可以利用该漏洞，执行恶意SQL语句。 discuz!x2.5 521交友插件...

ChangUonDyU - Extra File Chatbox v3.6.0 Multiple vulnerabilities

ChangUonDyU - Extra File Chatbox is a MyBB plugin used for live chatting with other users on the forum. The developer was probably quite lazyno offense because of the high amount of vulnerabilities in the plugin. With a short look there exists several persistent Cross Site Scripting...

Mandriva Linux Security Advisory : drupal (MDVSA-2013:074)

Updated drupal packages fix security vulnerabilities : Drupal core's text filtering system provides several features including removing inappropriate HTML tags and automatically linking content that appears to be a link. A pattern in Drupal's text matching was found to be inefficient with certain...

Todoo Forum 2.0 Cross Site Scripting / SQL Injection

SQL Injection + Parameter : idpost + http://localhost/todooforum/todooforum.php?cat=reponse&idforum=0&idpost=Injecthere&pg=1 + Parameter : pg + http://localhost/todooforum/todooforum.php?cat=reponse&idforum=0&idpost=1&pg=InjectHere + Cross-site scripting + Parameter : idpost +...

Todoo Forum 2.0 - todooforum.php Multiple Cross-Site Scripting Vulnerabilities

Todoo Forum 2.0 - todooforum.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/59069/info Todoo Forum is prone to multiple SQL-injection and cross-site scripting vulnerabilities. Exploiting these issues could allow an attacker to steal cookie-based...