PT-2015-6968

Name of the Vulnerable Software and Affected Versions WideImage version 11.02.19 Description A cross-site scripting XSS issue exists in the applyConvolution demo of WideImage, allowing remote attackers to inject arbitrary web script or HTML via the matrix parameter to "demo/index.php"...

CVE-2015-2969

CVE-2015-2969 corresponds to a persistent XSS in LEMON-S PHP Simple Oekaki BBS before version 1.21. The vulnerability is triggered in index.php through the oekakis parameter, allowing remote attackers to inject arbitrary scripts/HTML. Affected software: Simple Oekaki BBS ≤ v1.20 (prior to 1.21). ...

CVE-2015-2969

Cross-site scripting XSS vulnerability in index.php in LEMON-S PHP Simple Oekaki BBS before 1.21 allows remote attackers to inject arbitrary web script or HTML via the oekakis parameter...

PT-2015-6016

Name of the Vulnerable Software and Affected Versions LEMON-S PHP Simple Oekaki BBS versions prior to 1.21 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the oekakis parameter in t...

PT-2015-6017

Name of the Vulnerable Software and Affected Versions LEMON-S PHP Simple Oekaki BBS versions prior to 1.21 Description The issue allows remote attackers to delete arbitrary files. This is achieved via the oekakis parameter in the "index.php" file. Recommendations For versions prior to 1.21, updat...

CVE-2015-2969: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in LEMON-S PHP Simple Oekaki BBS before 1.21 allows remote attackers to inject arbitrary web script or HTML via the oekakis parameter...

CVE-2015-2970: Improper Limitation of a Pathname to a Restricted Directory

index.php in LEMON-S PHP Simple Oekaki BBS before 1.21 allows remote attackers to delete arbitrary files via the oekakis parameter...

JVN#67540183: Simple Oekaki BBS vulnerable to cross-site scripting

Simple Oekaki BBS provided by LEMON-S PHP contains a persistent cross-site scripting CWE-79 vulnerability due to the processing of oekakis parameter in index.php. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Software Update to the latest version...

CVE-2015-5066

Multiple cross-site scripting XSS vulnerabilities in the MetalGenix GeniXCMS 0.0.3 allow remote attackers to inject arbitrary web script or HTML via the 1 content or 2 title field in an add action in the posts page to index.php or the 3 q parameter in the posts page to index.php...

CVE-2015-5066

Multiple cross-site scripting XSS vulnerabilities in the MetalGenix GeniXCMS 0.0.3 allow remote attackers to inject arbitrary web script or HTML via the 1 content or 2 title field in an add action in the posts page to index.php or the 3 q parameter in the posts page to index.php...

GeniXCMS 0.0.3 - Cross-Site Scripting

GeniXCMS 0.0.3 - Cross-Site Scripting Exploit Title: Persistent XSS Google Dork: intitle: Persistent XSS Date: 2015-06-21 Exploit Author: John Page hyp3rlinx Website: hyp3rlinx.altervista.org Vendor Homepage: genixcms.org Software Link: genixcms.org Version: 0.0.3 Tested on: windows 7 Category:...

PT-2015-6764

Name of the Vulnerable Software and Affected Versions GeniXCMS version 0.0.3 Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting XSS attacks. This can be achieved via the content or title field in an add action in the...

ClickHeat Cross-Site Request Forgery Vulnerability

ClickHeat is Labsmedia Cloud Computing Center developed a set of open source website heat map generation tool . The tool can count the heat distribution map of user clicks on a page , and support for Chinese display . ClickHeat 1.14 and previous versions of cross-site request forgery vulnerabilit...

CVE-2015-4713

Affected software: ApPHP Hotel Site 3.x.x. Vulnerability: SQL injection via the pid parameter to index.php, enabling arbitrary SQL commands to be executed by remote attackers. Root cause (as stated): Insufficient input filtering/validation of the pid parameter, permitting crafted input to alter S...

CVE-2015-4713: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in ApPHP Hotel Site 3.x.x allows remote editors to execute arbitrary SQL commands via the pid parameter to index.php...

PT-2015-6675

Name of the Vulnerable Software and Affected Versions ApPHP Hotel Site versions 3.x.x Description The issue allows remote editors to execute arbitrary SQL commands. This is achieved via the pid parameter to the "index.php" endpoint. Recommendations For ApPHP Hotel Site versions 3.x.x, avoid using...

PT-2015-6659

Name of the Vulnerable Software and Affected Versions ClickHeat versions 1.14 and earlier Description A cross-site request forgery issue allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via a config action to "index.php"...

CVE-2015-4656: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Synology Photo Station before 6.3-2945 allow remote attackers to inject arbitrary web script or HTML via the 1 success parameter to login.php or 2 crafted URL parameters to index.php, as demonstrated by the t parameter to photo/...

PT-2015-6656

Name of the Vulnerable Software and Affected Versions Synology Photo Station versions prior to 6.3-2945 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the success parameter to "login.php" or crafted URL parameters to "index.php", suc...

CVE-2015-4659: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in ClickHeat 1.14 and earlier allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via a config action to index.php...