PT-2015-3632

Name of the Vulnerable Software and Affected Versions Savsoft Quiz affected versions not specified Description A cross-site request forgery CSRF issue exists in the index.php/user data/insert user endpoint, allowing remote attackers to hijack administrator authentication for requests that create...

PT-2015-3651

Name of the Vulnerable Software and Affected Versions Maian Weblog versions 4.0 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML via the name, email, or subject parameter in a contact action to "index.php". This can lead to cross-site scripting XSS...

PT-2015-3679

Name of the Vulnerable Software and Affected Versions couponPHP versions prior to 1.2.0 Description The issue concerns multiple cross-site scripting XSS vulnerabilities in the admin area. These vulnerabilities allow remote administrators to inject arbitrary web script or HTML via various...

PT-2015-3681

Name of the Vulnerable Software and Affected Versions DomPHP versions 0.83 and earlier Description A directory traversal issue exists, allowing remote attackers to have an unspecified impact by including a .. dot dot in the url parameter to the "photoalbum/index.php" endpoint. Recommendations For...

Multiple HTML Injection Vulnerabilities in BEdita CMS 'index.php'

BEdita is a web development framework that provides a full-featured content management system. Multiple HTML injection vulnerabilities exist in BEdita CMS 'index.php' because it fails to properly filter user-supplied input. An attacker can execute the provided HTML and script code in the context ...

CVE-2015-0917

Cross-site scripting XSS vulnerability in the backend in Kajona before 4.6.3 allows remote attackers to inject arbitrary web script or HTML via the action parameter to index.php...

CVE-2015-0917

Cross-site scripting XSS vulnerability in the backend in Kajona before 4.6.3 allows remote attackers to inject arbitrary web script or HTML via the action parameter to index.php...

CVE-2015-0917

Summary: CVE-2015-0917 is an XSS vulnerability in Kajona CMS backend before version 4.6.3, exploitable via the action parameter to index.php. Connected sources confirm the affected product and vulnerable parameter; no explicit remediation details are provided in the supplied documents. The exploi...

CVE-2015-0917: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the backend in Kajona before 4.6.3 allows remote attackers to inject arbitrary web script or HTML via the action parameter to index.php...

PT-2015-4967

Name of the Vulnerable Software and Affected Versions Kajona versions prior to 4.6.3 Description A cross-site scripting XSS issue exists in the backend of Kajona, allowing remote attackers to inject arbitrary web script or HTML via the action parameter to "index.php". Recommendations For versions...

PT-2015-4269

Name of the Vulnerable Software and Affected Versions HumHub versions 0.10.0-rc.1 and earlier Description The issue allows remote authenticated users to execute arbitrary SQL commands via the from parameter to "index.php". This can be leveraged for cross-site scripting XSS attacks via a request...

Sql injection

Multiple SQL injection vulnerabilities in index.php in SweetRice CMS before 0.6.7.1 allow remote attackers to execute arbitrary SQL commands via 1 the filename parameter in an attachment action, 2 the post parameter in a showcomment action, 3 the sys-name parameter in an rssfeed action, or 4 the...

CVE-2010-5317

Multiple SQL injection vulnerabilities in index.php in SweetRice CMS before 0.6.7.1 allow remote attackers to execute arbitrary SQL commands via 1 the filename parameter in an attachment action, 2 the post parameter in a showcomment action, 3 the sys-name parameter in an rssfeed action, or 4 the...

CVE-2010-5316: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in as/index.php in SweetRice CMS before 0.6.7.1 allows remote attackers to inject arbitrary web script or HTML via a topheight cookie...

CVE-2010-5317: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in index.php in SweetRice CMS before 0.6.7.1 allow remote attackers to execute arbitrary SQL commands via 1 the filename parameter in an attachment action, 2 the post parameter in a showcomment action, 3 the sys-name parameter in an rssfeed action, or 4 the...

CVE-2010-5318: Undefined Security Weakness

The password-reset feature in as/index.php in SweetRice CMS before 0.6.7.1 allows remote attackers to modify the administrator's password by specifying the administrator's e-mail address in the email parameter...

PT-2015-3474

Name of the Vulnerable Software and Affected Versions SweetRice CMS versions prior to 0.6.7.1 Description The issue concerns the password-reset feature in the as/index.php file. It allows remote attackers to change the administrator's password by providing the administrator's e-mail address in th...

CVE-2014-9445

SQL injection vulnerability in incl/create.inc.php in Installatron GQ File Manager 0.2.5 allows remote attackers to execute arbitrary SQL commands via the create parameter to index.php. NOTE: this can be leveraged for cross-site scripting XSS attacks by creating a file that generates an error...

Sql injection

SQL injection vulnerability in incl/create.inc.php in Installatron GQ File Manager 0.2.5 allows remote attackers to execute arbitrary SQL commands via the create parameter to index.php. NOTE: this can be leveraged for cross-site scripting XSS attacks by creating a file that generates an error...

PT-2015-4208

Name of the Vulnerable Software and Affected Versions Installatron GQ File Manager version 0.2.5 Description The issue allows remote attackers to execute arbitrary SQL commands via the create parameter to "index.php". This can be leveraged for cross-site scripting XSS attacks by creating a file...