CONTROLzx Hms 3.3.4 - server_management.php?plan_id Cross-Site Scripting

CONTROLzx Hms 3.3.4 - servermanagement.php?planid Cross-Site Scripting source: https://www.securityfocus.com/bid/17282/info CONTROLzx HMS is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An...

CONTROLzx Hms 3.3.4 - shared_order.php?sharedPlanID Cross-Site Scripting

CONTROLzx Hms 3.3.4 - sharedorder.php?sharedPlanID Cross-Site Scripting source: https://www.securityfocus.com/bid/17282/info CONTROLzx HMS is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An...

CONTROLzx Hms 3.3.4 - 'shared_order.php?sharedPlanID' Cross-Site Scripting

source: https://www.securityfocus.com/bid/17282/info CONTROLzx HMS is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code executed...

CVE-2005-4366

Multiple SQL injection vulnerabilities in DRZES HMS 3.2 allow remote attackers to execute arbitrary SQL commands via the 1 planid parameter to a domains.php, b viewusage.php, c popaccounts.php, d databases.php, e ftpusers.php, f crons.php, g passdirs.php, h zonefiles.php, i htaccess.php, and j...

CVE-2005-4366

Multiple SQL injection vulnerabilities in DRZES HMS 3.2 allow remote attackers to execute arbitrary SQL commands via the 1 planid parameter to a domains.php, b viewusage.php, c popaccounts.php, d databases.php, e ftpusers.php, f crons.php, g passdirs.php, h zonefiles.php, i htaccess.php, and j...

CVE-2005-4367

Cross-site scripting XSS vulnerability in registerdomain.php in DRZES HMS 3.2 allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters, possibly the "Domain Availability" field. NOTE: this issue was later reported to affect CONTROLzx renamed from DRZES 3.3....

CVE-2005-4367

The CVE-2005-4367 entry describes an XSS in DRZES HMS 3.2 (and later CONTROLzx, renamed from DRZES, 3.3.4) via register_domain.php, likely through unspecified search parameters (potentially the Domain Availability field). Affected function is register_domain.php; root cause is improper handling/e...

CVE-2005-4366

CVE-2005-4366 describes multiple SQL injection vulnerabilities in DRZES HMS 3.2. The issues allow remote attackers to execute arbitrary SQL commands via various parameters across several PHP scripts (e.g., plan_id to domains.php, viewusage.php, pop_accounts.php, databases.php, ftp_users.php, cron...

CVE-2005-4136

Cross-site scripting XSS vulnerability in login.php in DRZES HMS 3.2 allows remote attackers to inject arbitrary web script or HTML via the customerEmailAddress parameter...

CVE-2005-4137

SQL injection vulnerability in viewinvoice.php in DRZES HMS 3.2 allows remote attackers to execute arbitrary SQL commands via the invoiceID parameter...

CVE-2005-4136

CVE-2005-4136 describes a Cross-site Scripting (XSS) vulnerability in DRZES HMS 3.2, specifically in login.php where the customerEmailAddress parameter can be exploited to inject arbitrary web script/HTML. The issue affects the login process and can be triggered remotely, with a NVD base score of...

CVE-2005-4137

SQL injection vulnerability in viewinvoice.php in DRZES HMS 3.2 allows remote attackers to execute arbitrary SQL commands via the invoiceID parameter...

CVE-2005-4137

CVE-2005-4137 describes an SQL injection in DRZES HMS 3.2: viewinvoice.php allows remote attackers to manipulate the backend via the invoiceID parameter, enabling arbitrary SQL execution. This is part of broader SQL injection findings in DRZES HMS 3.2 (noting that the 4137 vector is explicitly th...

DRZES HMS XSS and SQL Injection Vulnerabilities

Description: http://www.drzes.com/ An all-in-one web hosting management system. A feature-rich, robust, easy-to-use control panel and billing system. A "self-branding" web hosting management system. No DRZES branding. Both the admin and customer can control multiple plans/servers from one...

DRZES Hms 3.2 - login.php Cross-Site Scripting

DRZES Hms 3.2 - login.php Cross-Site Scripting source: https://www.securityfocus.com/bid/15766/info DRZES HMS is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to have...

DRZES Hms 3.2 - Multiple SQL Injections

DRZES Hms 3.2 - Multiple SQL Injections source: https://www.securityfocus.com/bid/15644/info DRZES HMS is prone to multiple SQL injection vulnerabilities. These issues are due to a lack of proper sanitization of user-supplied input before it is used in SQL queries. Successful exploitation could...

DRZES HMS 3.2 Multiple vuln.

DRZES HMS 3.2 - Hosting Management System -multiple SQL inj. vuln. and XSS vuln. Vuln. dicovered by : r0t Date: 25 nov. 2005 Orginal advisory:http://pridels.blogspot.com/2005/11/drzes-hms-32-multiple-vuln.html Vendor:http://drzes.com/ affected version:3.2 and prior Product description: Increase...