CVE-2011-5316

Cross-site request forgery CSRF vulnerability in admin/index.php in Cambio 0.5a nightly r37 allows remote attackers to hijack the authentication of administrators for requests that modify credentials via a user save action...

CVE-2011-5307

Cross-site scripting XSS vulnerability in index.php in the PhotoSmash plugin 1.0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter...

CVE-2011-5315

Cross-site request forgery CSRF vulnerability in admin/index.php in whCMS 0.115 alpha allows remote attackers to hijack the authentication of administrators for requests that modify credentials via a user save action...

CVE-2011-5316

Cross-site request forgery CSRF vulnerability in admin/index.php in Cambio 0.5a nightly r37 allows remote attackers to hijack the authentication of administrators for requests that modify credentials via a user save action...

CVE-2011-5307

Cross-site scripting XSS vulnerability in index.php in the PhotoSmash plugin 1.0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter...

CVE-2011-5316

The CVE-2011-5316 entry concerns a CSRF flaw in the Cambio 0.5a nightly r37 release, specifically affecting the admin/index.php handler. The underlying issue allows an attacker to hijack an administrator’s session and perform credential-changing actions via a seemingly legitimate user-initiated r...

CVE-2011-5307

CVE-2011-5307 is a publicly known XSS vulnerability in the WordPress PhotoSmash plugin version 1.0.1, exposed via index.php where the action parameter can be exploited to inject arbitrary web scripts/HTML. The NVD entry lists a MEDIUM severity (CVSS2: AV:N/AC:M/Au:N/I:P/C:N, base 4.3) with no con...

WordPress PhotoSmash Plugin <= 1.0.1 - XSS

Because of this vulnerability in index.php, the attackers can inject arbitrary web script or HTML via the "action" parameter. Solution Update the plugin...

CVE-2011-5316: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in admin/index.php in Cambio 0.5a nightly r37 allows remote attackers to hijack the authentication of administrators for requests that modify credentials via a user save action...

CVE-2011-5315: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in admin/index.php in whCMS 0.115 alpha allows remote attackers to hijack the authentication of administrators for requests that modify credentials via a user save action...

CVE-2011-5307: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in the PhotoSmash plugin 1.0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter...

CVE-2011-5314: Exposure of Sensitive Information to an Unauthorized Actor

templates/default/index.php in Redaxscript 0.3.2 allows remote attackers to obtain sensitive information via a direct request, which reveals the full path in an error message...

PT-2015-3503

Name of the Vulnerable Software and Affected Versions PhotoSmash plugin version 1.0.1 for WordPress Description The issue is related to a cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary web script or HTML via the action parameter in the index.php file...

PT-2015-3510

Name of the Vulnerable Software and Affected Versions Redaxscript version 0.3.2 Description The issue allows remote attackers to obtain sensitive information via a direct request to templates/default/index.php, which reveals the full path in an error message. Recommendations For Redaxscript versi...

PT-2015-3511

Name of the Vulnerable Software and Affected Versions whCMS version 0.115 alpha Description A cross-site request forgery issue exists, allowing remote attackers to hijack administrator authentication for requests that modify credentials via a user save action. Recommendations For whCMS version...

PT-2015-3512

Name of the Vulnerable Software and Affected Versions Cambio version 0.5a nightly r37 Description A cross-site request forgery issue exists, allowing remote attackers to hijack administrator authentication for requests that modify credentials via a user save action. This occurs in the...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in templates/2k11/admin/overview.inc.tpl in Serendipity before 2.0-rc2 allow remote attackers to inject arbitrary web script or HTML via a blog comment in the QUERYSTRING to serendipity/index.php...

Sql injection

bbfuncunsub.php in MiniBB 3.1 before 20141127 uses an incorrect regular expression, which allows remote attackers to conduct SQl injection attacks via the code parameter in an unsubscribe action to index.php...

CVE-2014-9254

bbfuncunsub.php in MiniBB 3.1 before 20141127 uses an incorrect regular expression, which allows remote attackers to conduct SQl injection attacks via the code parameter in an unsubscribe action to index.php...

CVE-2014-9254: Improper Neutralization of Special Elements used in an SQL Command

bbfuncunsub.php in MiniBB 3.1 before 20141127 uses an incorrect regular expression, which allows remote attackers to conduct SQl injection attacks via the code parameter in an unsubscribe action to index.php...