CVE-2017-9555

Cross-site scripting XSS vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.0-3414 allows remote attackers to inject arbitrary web script or HTML via the image parameter...

CVE-2017-9555

Cross-site scripting XSS vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.0-3414 allows remote attackers to inject arbitrary web script or HTML via the image parameter...

CVE-2017-9555

Cross-site scripting XSS vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.0-3414 allows remote attackers to inject arbitrary web script or HTML via the image parameter...

Gratipay: Application-level DoS on image's "size" parameter.

Summary --- The size parameter located on images is vulnerable to DoS. By modifying the parameter's value an attacker can cause the application to work very slowly. Description --- The issue is located in the getimageurl function in gratipay/models/team/init.py and can be exploited by replacing t...

Code injection

Pluck CMS 4.7.2 allows remote attackers to obtain sensitive information by 1 changing "PHPSESSID" to an array; 2 adding non-alphanumeric chars to "PHPSESSID"; 3 changing the image parameter to an array; or 4 changing the image parameter to a string, which reveals the installation path in an error...

DouPHP admin/article.php image parameter SQL injection

No description provided by source...

CVE-2014-9562

Cross-site scripting XSS vulnerability in displaydialog.php in M2 OptimalSite 0.1 and 2.4 allows remote attackers to inject arbitrary web script or HTML via the image parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in displaydialog.php in M2 OptimalSite 0.1 and 2.4 allows remote attackers to inject arbitrary web script or HTML via the image parameter...

Oracle Java SE Multiple Vulnerabilities -01 March 13 (Windows)

This host is installed with Oracle Java SE and is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: gboraclejavasemultvuln01mar13win.nasl 7699 2017-11-08 12:10:34Z santu $ Oracle Java SE Multiple Vulnerabilities -01 March 13 Windows Authors: Arun Kallavi Copyright: Copyright c 20...

Cross site scripting

Cross-site scripting XSS vulnerability in image/view.php in CANDID allows remote attackers to inject arbitrary web script or HTML via the imageid parameter...

CVE-2011-0773

Cross-site scripting XSS vulnerability in pivotx/modules/moduleimage.php in PivotX before 2.2.3 allows remote attackers to inject arbitrary web script or HTML via the image parameter...

Directory traversal

Directory traversal vulnerability in gallery/gallery.php in Wap-Motor before 18.1 allows remote attackers to read arbitrary files via a .. dot dot in the image parameter...

Sql injection

Multiple SQL injection vulnerabilities in Qsoft K-Rate Premium allow remote attackers to execute arbitrary SQL commands via 1 the $id variable in admin/includes/delecpac.php, 2 $ordorderid variable in payments/paymentreceived.php, 3 $id variable in includes/functions.php, and 4 unspecified...

CVE-2009-1809

Multiple cross-site scripting XSS vulnerabilities in myColex 1.4.2 allow remote attackers to inject arbitrary web script or HTML via 1 the year parameter to modules/kalender.php, 2 the Page parameter in a List action to modules/ereignis.php, 3 the Kontext parameter in a Search action to...

Directory traversal

thumbsup.php in Thumbs-Up 1.12, as used in LightNEasy "no database" aka flat and SQLite 1.2.2 and earlier, allows remote attackers to copy, rename, and read arbitrary files via directory traversal sequences in the image parameter with a modified cachedir parameter containing a %00 encoded null by...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in engine/modules/imagepreview.php in Datalife Engine 6.7 allows remote attackers to hijack the authentication of arbitrary users for requests that use a modified image parameter...

CVE-2008-6466

SQL injection vulnerability in imagegallery.php in the Akira Powered Image Gallery imagegallery plugin 0.9.6.2 for e107 allows remote attackers to execute arbitrary SQL commands via the image parameter in an image-detail action...

Cross site scripting

Cross-site scripting XSS vulnerability in index.php in JV2 Folder Gallery 3.1 allows remote attackers to inject arbitrary web script or HTML via the image parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-1634

Cross-site scripting XSS vulnerability in index.php in JV2 Folder Gallery 3.1 allows remote attackers to inject arbitrary web script or HTML via the image parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-1634

Cross-site scripting XSS vulnerability in index.php in JV2 Folder Gallery 3.1 allows remote attackers to inject arbitrary web script or HTML via the image parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...