CVE-2015-2677: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in ocPortal before 9.0.17 allow remote authenticated users to inject arbitrary web script or HTML via the 1 title or 2 text field in the cmscalendar page to cms/index.php; unspecified fields in 3 the cmspolls page to cms/index.php or 4 a new topic...

CVE-2015-2679: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in MetalGenix GeniXCMS before 0.0.2 allow remote attackers to execute arbitrary SQL commands via the 1 page parameter to index.php or 2 username parameter to gxadmin/login.php...

CVE-2015-2678: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in MetalGenix GeniXCMS before 0.0.2 allow remote attackers to inject arbitrary web script or HTML via the 1 cat parameter in the categories page to gxadmin/index.php or 2 page parameter to index.php...

CVE-2015-2680: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in MetalGenix GeniXCMS before 0.0.2 allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via a request in the users page to gxadmin/index.php...

PT-2015-5831

Name of the Vulnerable Software and Affected Versions GeniXCMS versions prior to 0.0.2 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the page parameter to "index.php" or the username parameter to "gxadmin/login.php". Recommendations For...

PT-2015-5830

Name of the Vulnerable Software and Affected Versions GeniXCMS version prior to 0.0.2 Description The issue allows remote attackers to inject arbitrary web script or HTML, which can lead to cross-site scripting XSS attacks. This is possible via the cat parameter in the categories page to...

PT-2015-5832

Name of the Vulnerable Software and Affected Versions MetalGenix GeniXCMS versions prior to 0.0.2 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via a request in the users pa...

CVE-2015-2562: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the Web-Dorado ECommerce WD comecommercewd component 1.2.5 for Joomla! allow remote attackers to execute arbitrary SQL commands via the 1 searchcategoryid, 2 sortorder, or 3 filtermanufacturerids in a displayproducts action to index.php...

PT-2015-5778

Name of the Vulnerable Software and Affected Versions com ecommercewd version 1.2.5 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the search category id, sort order, or filter manufacturer ids in a displayproducts action to "index.php"...

CVE-2015-2149: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the administrative backend in MyBB aka MyBulletinBoard before 1.8.4 allow remote authenticated users to inject arbitrary web script or HTML via the 1 MIME-type field in an add action in the config-attachmenttypes module to admin/index.php; 2...

PT-2015-1587

Name of the Vulnerable Software and Affected Versions Moodle versions 2.5.9 and earlier Moodle versions 2.6.x before 2.6.9 Moodle versions 2.7.x before 2.7.6 Moodle versions 2.8.x before 2.8.4 Description The issue is related to the lack of protection for service data in the message/index.php...

KingCms最新版（k9）注入1枚

简要描述： KingCms最新版（k9）注入1枚 详细说明： 朋友的公司想购买kingcms的授权，让我帮忙看下。发现kingcms很长一段时间没更新了，憋了一段时间放出了最新版的k92014-12-13更新，官网下下来学习一下。 在wooyun上看到了几个漏洞，如： WooYun: kingcms最新版sql注入漏洞 注入点：POST /apps/jianli/index.php HTTP/1.1 注入参数：where 问题文件在/apps/jianli/index.php function create $u=new user;$u-authrole'jianli'; $db=new...

KingCms最新版（k9）注入又1枚

简要描述： KingCms最新版（k9）注入又1枚 详细说明： 朋友的公司想购买kingcms的授权，让我帮忙看下。发现kingcms很长一段时间没更新了，憋了一段时间放出了最新版的k92014-12-13更新，官网下下来学习一下。 在wooyun上看到了几个漏洞，如： WooYun: kingcms最新版sql注入漏洞 注入点：POST /apps/jiaoyou/index.php HTTP/1.1 注入参数：where 问题文件在 /apps/jiaoyou/index.php function create $u=new user;$u-authrole'jiaoyou';...

CVE-2015-2259: UliCMS index.php cross-site request forgery

CVE-2015-2259 affects UliCMS via the index.php script, where improper validation enables a CSRF condition. An authenticated user visiting a crafted site could be forced to perform actions that add an administrator account, with potential for cross-site scripting and Web cache poisoning. The descr...

724CMS 5.01 / 4.59 / 4.01 / 3.01 Information Leakage

724CMS 5.01 Multiple Information Leakage Security Vulnerabilities Exploit Title: 724CMS Multiple Information Leakage Security Vulnerabilities Vendor: 724CMS Product: 724CMS Vulnerable Versions: 3.01 4.01 4.59 5.01 Tested Version: 5.01 Advisory Publication: March 14, 2015 Latest Update: March 14,...

Sql injection

Multiple SQL injection vulnerabilities in Betster aka PHP Betoffice 1.0.4 allow remote attackers to execute arbitrary SQL commands via the id parameter to 1 showprofile.php or 2 categoryedit.php or 3 username parameter in a login to index.php...

PT-2015-5679

Name of the Vulnerable Software and Affected Versions Betster aka PHP Betoffice version 1.0.4 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the id parameter to "showprofile.php" or "categoryedit.php", or the username parameter in a login...

PT-2015-5692

Name of the Vulnerable Software and Affected Versions WoltLab Community Gallery version 2.0 before 2014-12-26 Description The issue allows remote attackers to inject arbitrary web script or HTML via the parametersdata7title parameter in a "saveImageData" action to "index.php/AJAXProxy". This is a...

CVE-2015-2237: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Betster aka PHP Betoffice 1.0.4 allow remote attackers to execute arbitrary SQL commands via the id parameter to 1 showprofile.php or 2 categoryedit.php or 3 username parameter in a login to index.php...

CVE-2015-2182

Multiple cross-site scripting XSS vulnerabilities in ZeusCart 4 allow remote attackers to inject arbitrary web script or HTML via the 1 schltr parameter in a brands action or 2 brand parameter in a viewbrands action to index.php. NOTE: The search parameter vector is already covered by CVE-2010-53...