CVE-2017-9435: Improper Neutralization of Special Elements used in an SQL Command

Dolibarr ERP/CRM before 5.0.3 is vulnerable to a SQL injection in user/index.php searchsupervisor and searchstatut parameters...

PT-2017-18926

Name of the Vulnerable Software and Affected Versions BigTree CMS versions prior to 4.2.19 Description The issue is related to CSRF, allowing modification of user information, removal of packages, ignoring versions, and setting FTP directories. Specifically, it affects the...

PT-2017-18918

Name of the Vulnerable Software and Affected Versions Dolibarr ERP/CRM versions prior to 5.0.3 Description The issue concerns a SQL injection. It affects the user/index.php file, specifically the search supervisor and search statut parameters. Recommendations For versions prior to 5.0.3, update t...

fischkopf.de XSS vulnerability

Vulnerable URL: https://www.fischkopf.de/index.php?page=fischkopfwerdenstep1 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 106555 VIP website status:| No Check fischkopf.de SSL...

Cross-site Scripting (XSS)

Moodle is susceptible to cross-site scripting XSS attacks. The attacks are possible because the parameter passed to blog/index.php is not properly sanitized. It allows the attackers to inject arbitrary web script or HTML through it when Internet Explorer is used...

Sql injection

The VirtueMart comvirtuemart component 3.0.14 for Joomla! allows SQL injection by remote authenticated administrators via the virtuemartpaymentmethodid or virtuemartshipmentmethodid parameter to administrator/index.php...

Path Traversal

jokkedk/webgrind is vulnerable to path traversals. By using an absolute file path in the file parameter in index.php, attackers are able read an arbitrary file...

PT-2017-7893

Name of the Vulnerable Software and Affected Versions VirtueMart com virtuemart component version 3.0.14 for Joomla! Description The issue allows SQL injection by remote authenticated administrators. This can be achieved via the virtuemart paymentmethod id or virtuemart shipmentmethod id paramete...

CVE-2016-10379: Improper Neutralization of Special Elements used in an SQL Command

The VirtueMart comvirtuemart component 3.0.14 for Joomla! allows SQL injection by remote authenticated administrators via the virtuemartpaymentmethodid or virtuemartshipmentmethodid parameter to administrator/index.php...

CVE-2017-9252

andrzuk/FineCMS through 2017-05-28 is vulnerable to a reflected XSS in the search page via the text-search parameter to index.php in a route=search action...

CVE-2017-9252

andrzuk/FineCMS through 2017-05-28 is vulnerable to a reflected XSS in the search page via the text-search parameter to index.php in a route=search action...

CVE-2017-9252: Improper Neutralization of Input During Web Page Generation

andrzuk/FineCMS through 2017-05-28 is vulnerable to a reflected XSS in the search page via the text-search parameter to index.php in a route=search action...

asterios.tm XSS vulnerability

Vulnerable URL: https://asterios.tm/index.php?cmd=account&mod=recover Details: Description| Value ---|--- Patched:| No Latest check for patch:| 31.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 56154 VIP website status:| No Coordinated Disclosure Timeline:...

CVE-2017-9070

In MODX Revolution before 2.5.7, a user with resource edit permissions can inject an XSS payload into the title of any post via the pagetitle parameter to connectors/index.php...

CVE-2017-9067

In MODX Revolution before 2.5.7, when PHP 5.3.3 is used, an attacker is able to include and execute arbitrary files on the web server due to insufficient validation of the action parameter to setup/index.php, aka directory traversal...

Cross site scripting

In MODX Revolution before 2.5.7, a user with resource edit permissions can inject an XSS payload into the title of any post via the pagetitle parameter to connectors/index.php...

CVE-2017-9067

In MODX Revolution before 2.5.7, when PHP 5.3.3 is used, an attacker is able to include and execute arbitrary files on the web server due to insufficient validation of the action parameter to setup/index.php, aka directory traversal...

CVE-2017-9070

In MODX Revolution before 2.5.7, a user with resource edit permissions can inject an XSS payload into the title of any post via the pagetitle parameter to connectors/index.php...

CVE-2017-9067: Improper Limitation of a Pathname to a Restricted Directory

In MODX Revolution before 2.5.7, when PHP 5.3.3 is used, an attacker is able to include and execute arbitrary files on the web server due to insufficient validation of the action parameter to setup/index.php, aka directory traversal...

CVE-2017-9070: Improper Neutralization of Input During Web Page Generation

In MODX Revolution before 2.5.7, a user with resource edit permissions can inject an XSS payload into the title of any post via the pagetitle parameter to connectors/index.php...