Component realtyna SQL Injection Vulnerability in Joomla!

Joomla! is an open source content management system CMS. A SQL injection vulnerability exists in the Joomla! component realtyna, which allows remote attackers to execute arbitrary SQL commands with the help of the pid parameter in the comrpl operation of index.php...

Reinstallation vulnerability in zzcms version 7.2

ZZCMS highlights the investment and supply and demand functions, you can quickly build a product investment website. ZZCMS system v7.1 has a reinstallation vulnerability that allows an attacker to exploit the vulnerability by visiting /install/index.php, submitting: POST request: submit=1&step=4,...

Mobiketa Cross-Site Request Forgery Vulnerability

Mobiketa is a full-featured SMS and language management software. A cross-site request forgery vulnerability exists in index/php in Mobiketa version 1.0, which can be exploited by remote attackers to perform unauthorized operations and gain access to the affected application...

Joomla! PayPlans Extension 'index.php' SQL Injection Vulnerability

Joomla! is an open source content management system. An SQL injection vulnerability exists in Joomla! PayPlans Extension 'index.php'. Because the program fails to adequately filter user-supplied data before it is used in SQL queries, an attacker can exploit the vulnerability to access or modify...

CubeCart Stored Cross-Site Scripting Vulnerability

CubeCart is an open source PHP e-commerce software system. A stored cross-site scripting vulnerability exists in CubeCart. Due to insufficient filtering of user-supplied data via the "firstname" and "lastname" HTTP POST parameters passed to the "/index.php" script input, a remotely-authenticated...

Roundcube Remote Code Execution Vulnerability

Roundcube is open source software. A remote code execution vulnerability exists in Roundcube. Because the "skin" HTTP POST parameter is not sufficiently filtered in the "/index.php" script, a remotely authenticated attacker can use a path traversal sequence e.g. "... /... /" to be loaded from any...

Zeuscart 'index.php' Cross-Site Scripting Vulnerability

ZeusCart is an open source shopping system based on PHP and MySQL designed for small and medium-sized online stores. A cross-site scripting vulnerability exists in Zeuscart 'index.php', which allows remote attackers to exploit the vulnerability and inject malicious script or HTML code to obtain...

Joomla! jNews component 'index.php' SQL Injection Vulnerability

Joomla! is an open source content management system. jNews is one of the email subscription system components. A SQL injection vulnerability exists in the Joomla! jNews component 'index.php', which allows remote attackers to exploit the vulnerability by submitting a specially crafted SQL query...

CVE-2015-5075

Cross-site request forgery CSRF vulnerability in X2Engine X2CRM before 5.2 allows remote attackers to hijack the authentication of administrators for requests that create an administrative account via a crafted request to index.php/users/create...

Joomla! googleSearch (CSE) component cross-site scripting vulnerability

Joomla! is an open source content management system. googleSearch component for Joomla! is a custom search engine component for Joomla! A cross-site scripting vulnerability in googleSearch component 3.0.2 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the q paramet...

Twit BBS vulnerable to cross-site scripting

Overview Twit BBS provided by LEMON-S PHP contains a persistent cross-site scripting CWE-79 vulnerability due to the processing of imagetitle parameter in index.php. Shoji Baba reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...

LEMON-S PHP Simple Oekaki BBS Cross-Site Scripting Vulnerability

LEMON-S PHP Simple Oekaki BBS is a PHP-based electronic bulletin board BBS script. A cross-site scripting vulnerability exists in the index.php script in LEMON-S PHP Simple Oekaki BBS versions prior to 1.21. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...

WideImage 'index.php' Cross-Site Scripting Vulnerability

WideImage is an open source for image processing object-oriented PHP library . A cross-site scripting vulnerability exists in WideImage that stems from the program's failure to adequately filter user-submitted input. When a user browses the affected site, their browser will execute arbitrary scri...

File Inclusion Vulnerability in Zblog

Zblog is based on the Asp platform Blog blog weblog program. Zblog has a file inclusion vulnerability. zbinstall/index.php does not escape POST, and an attacker can truncate the .php that follows...

DLGuard 'index.php' Information Disclosure Vulnerability

DLGuard is a secure, automated online sales website software designed for Internet businesses. The software offers multiple payment options, secure download links and pages, customer tracking and reporting, and more. An information disclosure vulnerability exists in DLGuard that originates from t...

DLGuard Cross-Site Scripting Vulnerability

DLGuard is a complete sales and customer management system used to protect and streamline online business. A cross-site scripting vulnerability exists in DLGuard. A remote attacker can leverage the 'page', 'c' or 'redirect' parameters in the index.php script or the main page's 'search' field...

my little forum SQL Injection Vulnerability

my little forum is a forum program. A SQL injection vulnerability exists in my little forum 'index.php', which allows remote attackers to submit specially crafted SQL queries to manipulate or obtain database data...

Multiple SQL Injection Vulnerabilities in EcommerceMajor

ecommerceMajor is a PHP-based content management system CMS for building e-commerce portals developed by software developer Bhaskar. EcommerceMajor has multiple SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands via the productbycat parameter product.php o...

EUVD-2015-1559

Multiple cross-site scripting XSS vulnerabilities in Gecko CMS 2.2 and 2.3 allow remote attackers to inject arbitrary web script or HTML via the 1 horder, 2 jakcatid, 3 jakcontent, 4 jakcss, 5 jakdeletelog, 6 jakemail, 7 jakextfile, 8 jakfile, 9 jakhookshow, 10 jakimg, 11 jakjavascript, 12...

SweetRice CMS Has Multiple SQL Injection Vulnerabilities

SweetRice is a simple content management system developed using PHP. Multiple SQL injection vulnerabilities in index.php in SweetRice CMS versions prior to 0.6.7.1 allow remote attackers to exploit the vulnerabilities to execute arbitrary SQL commands...