PT-2017-11009

Name of the Vulnerable Software and Affected Versions wordpress plugin surveys version 1.01.8 Description The issue arises from the code in survey form.php, which fails to sanitize the action variable before incorporating it into an SQL query. This lack of sanitization can lead to potential SQL...

Cross site scripting

The callmsg function in controllers/Form.php in dayrui FineCms 5.0.11 might have XSS related to the Referer HTTP header with Internet Explorer...

CVE-2017-14195

The callmsg function in controllers/Form.php in dayrui FineCms 5.0.11 might have XSS related to the Referer HTTP header with Internet Explorer...

CVE-2017-14195

The callmsg function in controllers/Form.php in dayrui FineCms 5.0.11 might have XSS related to the Referer HTTP header with Internet Explorer...

CVE-2017-14195: Improper Neutralization of Input During Web Page Generation

The callmsg function in controllers/Form.php in dayrui FineCms 5.0.11 might have XSS related to the Referer HTTP header with Internet Explorer...

PT-2017-13297

Name of the Vulnerable Software and Affected Versions FineCms version 5.0.11 Description The issue is related to the call msg function in the controllers/Form.php file, potentially allowing XSS attacks related to the Referer HTTP header, specifically with Internet Explorer. Recommendations For...

PT-2017-12925

Name of the Vulnerable Software and Affected Versions FormCraft Basic plugin version 1.0.5 Description The issue concerns SQL injection in the id parameter to the "form.php" endpoint. Recommendations For FormCraft Basic plugin version 1.0.5, avoid using the id parameter in the form.php endpoint...

CVE-2017-13137: Improper Neutralization of Special Elements used in an SQL Command

The FormCraft Basic plugin 1.0.5 for WordPress has SQL injection in the id parameter to form.php...

CVE-2015-2690

Multiple cross-site scripting XSS vulnerabilities in views/add-license-form.php in the Digium Addons module digiumaddoninstaller before 2.11.0.7 for FreePBX allow remote attackers to inject arbitrary web script or HTML via the 1 addlicensekey, 2 addlicensefirstname, 3 addlicenselastname, 4...

CVE-2015-2690: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in views/add-license-form.php in the Digium Addons module digiumaddoninstaller before 2.11.0.7 for FreePBX allow remote attackers to inject arbitrary web script or HTML via the 1 addlicensekey, 2 addlicensefirstname, 3 addlicenselastname, 4...

PT-2015-3493

Name of the Vulnerable Software and Affected Versions TTChat version 1.0.4 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. Specifically, the vulnerabilities can be exploited via...

Sql injection

SQL injection vulnerability in XRMS CRM, possibly 1.99.2, allows remote attackers to execute arbitrary SQL commands via the userid parameter to plugins/webform/new-form.php, which is not properly handled by plugins/useradmin/fingeruser.php...

PT-2014-6506

Name of the Vulnerable Software and Affected Versions XRMS CRM version 1.99.2 Description The issue allows remote attackers to execute arbitrary SQL commands via the user id parameter to "plugins/webform/new-form.php", which is not properly handled by "plugins/useradmin/fingeruser.php"...

CVE-2014-5520: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in XRMS CRM, possibly 1.99.2, allows remote attackers to execute arbitrary SQL commands via the userid parameter to plugins/webform/new-form.php, which is not properly handled by plugins/useradmin/fingeruser.php...

PT-2014-5391

Name of the Vulnerable Software and Affected Versions Moodle versions 2.3.11 and earlier, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, 2.7.x before 2.7.1 Description The issue allows remote authenticated users to bypass intended access restrictions by leveraging two or more group...

CVE-2014-4555

CVE-2014-4555 is an XSS vulnerability in the WordPress plugin Style It (versions 1.0 and earlier). The flaw exists in fonts/font-form.php and allows remote attackers to inject arbitrary JavaScript/HTML via the mode parameter. Exploitation status is not detailed in the provided documents, but mult...

PT-2014-5954

Name of the Vulnerable Software and Affected Versions EnvialoSimple: Email Marketing and Newsletters plugin versions prior to 1.98 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML...

PT-2014-5963

Name of the Vulnerable Software and Affected Versions Oleggo LiveStream plugin versions 0.2.6 and earlier Description The issue is related to a cross-site scripting XSS vulnerability. This allows remote attackers to inject arbitrary web script or HTML via the msg parameter in the twitter login...

PT-2014-5974

Name of the Vulnerable Software and Affected Versions Style It plugin versions 1.0 and earlier for WordPress Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the mode parameter in the fonts/font-form.php file. Recommendation...

CVE-2014-4555: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in fonts/font-form.php in the Style It plugin 1.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the mode parameter...