CVE-2014-4735

Cross-site scripting XSS vulnerability in MyWebSQL 3.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the table parameter to index.php...

Cross site scripting

Cross-site scripting XSS vulnerability in MyWebSQL 3.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the table parameter to index.php...

PT-2014-6082

Name of the Vulnerable Software and Affected Versions MyWebSQL versions 3.4 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML via the table parameter to "index.php". This is a cross-site scripting XSS issue. Recommendations For MyWebSQL versions 3.4...

CVE-2014-4735: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in MyWebSQL 3.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the table parameter to index.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Adiscon LogAnalyzer before 3.6.6 allow remote attackers to inject arbitrary web script or HTML via the hostname in 1 index.php or 2 detail.php...

CVE-2014-6070

Multiple cross-site scripting XSS vulnerabilities in Adiscon LogAnalyzer before 3.6.6 allow remote attackers to inject arbitrary web script or HTML via the hostname in 1 index.php or 2 detail.php...

PT-2014-7023

Name of the Vulnerable Software and Affected Versions LogAnalyzer versions prior to 3.6.6 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The injection can occur via the hostname...

CVE-2014-6070: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Adiscon LogAnalyzer before 3.6.6 allow remote attackers to inject arbitrary web script or HTML via the hostname in 1 index.php or 2 detail.php...

CVE-2014-5519: Improper Control of Generation of Code

The Ploticus module in PhpWiki 1.5.0 allows remote attackers to execute arbitrary code via shell metacharacters in a device option in the editcontent parameter to index.php/HeIp. NOTE: some of these details are obtained from third party information...

PT-2014-6505

Name of the Vulnerable Software and Affected Versions PhpWiki version 1.5.0 Description The issue allows remote attackers to execute arbitrary code via shell metacharacters in a device option in the editcontent parameter to "index.php/HeIp". Recommendations For PhpWiki version 1.5.0, avoid using...

CVE-2014-4929: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the routing component in ownCloud Server before 5.0.17 and 6.0.x before 6.0.4 allows remote attackers to include and execute arbitrary local files via a .. dot dot in a filename, related to index.php...

PT-2014-6425

Name of the Vulnerable Software and Affected Versions Disqus Comment System plugin version 2.77 Description The issue affects the Disqus Comment System plugin, allowing remote attackers to hijack the authentication of administrators. This can be achieved through multiple cross-site request forger...

CVE-2014-5346: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the Disqus Comment System plugin 2.77 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 activate or 2 deactivate the plugin via the active parameter to wp-admin/edit-comments.php, 3...

Sql injection

Multiple SQL injection vulnerabilities in ZPanel 10.0.1 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 resetkey or 2 inConfEmail parameter to index.php, a different vulnerability than CVE-2012-5685...

CVE-2012-6654

CVE-2012-6654 corresponds to multiple SQL injection vulnerabilities in ZPanel 10.0.1 and earlier, allowing remote attackers to execute arbitrary SQL commands via the (1) resetkey or (2) inConfEmail parameters to index.php. This vulnerability is explicitly stated as different from CVE-2012-5685. T...

CVE-2012-6654: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in ZPanel 10.0.1 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 resetkey or 2 inConfEmail parameter to index.php, a different vulnerability than CVE-2012-5685...

PT-2014-2419

Name of the Vulnerable Software and Affected Versions ZPanel versions 10.0.1 and earlier Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the resetkey or inConfEmail parameter to the "index.php" endpoint. Recommendations For ZPanel versions...

PT-2014-2279

Name of the Vulnerable Software and Affected Versions Microcart version 1.0 Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting XSS attacks. This can occur through various means, including the PATH INFO or query string ...

ThinkSAAS 2.2 GET型CSRF到Getshell

简要描述： 后台Getshell本想在XSS漏洞里一起提交的。。。结果我给忘了。 不过后来发现这个洞是Get型的CSRF，利用方便，老少咸宜，在社区CMS中可以说威力无限呀。 详细说明： /app/system/action/plugin.php 83行： case "delete": $apps = $GET'apps'; $pname = $GET'pname'; delDir'plugins/'.$apps.'/'.$pname; qiMsg'删除成功！'; break; 获得了GET到的值以后拼接成路径以后传入delDir函数。delDir函数： / 删除文件夹和文件夹下所有的文...

DirPHP 'path/index.php' Local File Include Vulnerability

DirPHP is prone to local file inclusion vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...