CVE-2014-3991

Multiple cross-site scripting XSS vulnerabilities in Dolibarr ERP/CRM 3.5.3 allow remote attackers to inject arbitrary web script or HTML via the 1 dolusejmobile, 2 doloptimizesmallscreen, 3 dolnomousehover, 4 dolhidetopmenu, 5 dolhideleftmenu, 6 mainmenu, or 7 leftmenu parameter to index.php; th...

CVE-2014-3991: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Dolibarr ERP/CRM 3.5.3 allow remote attackers to inject arbitrary web script or HTML via the 1 dolusejmobile, 2 doloptimizesmallscreen, 3 dolnomousehover, 4 dolhidetopmenu, 5 dolhideleftmenu, 6 mainmenu, or 7 leftmenu parameter to index.php; th...

CVE-2014-3992: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM 3.5.3 allow remote authenticated users to execute arbitrary SQL commands via the 1 entity parameter in an update action to user/fiche.php or 2 sortorder parameter to user/group/index.php...

CVE-2014-4850

SQL injection vulnerability in index.php in FoeCMS allows remote attackers to execute arbitrary SQL commands via the i parameter...

Sql injection

SQL injection vulnerability in index.php in FoeCMS allows remote attackers to execute arbitrary SQL commands via the i parameter...

CVE-2014-4850: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in FoeCMS allows remote attackers to execute arbitrary SQL commands via the i parameter...

PT-2014-6164

Name of the Vulnerable Software and Affected Versions FoeCMS affected versions not specified Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the i parameter in the "index.php" file. Recommendations At the moment, there is no information about ...

maccms 8 /index.php SQL注入漏洞

No description provided by source...

CVE-2014-4742

Cross-site scripting XSS vulnerability in system/classlink.php in the System module modulesystem in Kajona before 4.5 allows remote attackers to inject arbitrary web script or HTML via the systemid parameter in a mediaFolder action to index.php...

PT-2014-6088

Name of the Vulnerable Software and Affected Versions Kajona versions prior to 4.5 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the systemid parameter in a mediaFolder action to...

cmseasy 反射型XSS无视浏览器filter无视360webscan

简要描述： RT，cmseasy后台是可以csrf getshell的。但我这里，就算以后cmseasy后台加token、验证referer，我也不怕了，反正是XSS，可以窃取token的，referer也是本站。 详细说明： 这个反射型XSS出在/bbs/index.php中，第4行： window.location.href='". strreplace'/bbs', '', $SERVER'REQUESTURI'."';"; requireonce 'bbspublic.php'; $category = dbbbscategory::getInstance;...

CVE-2014-4594

Cross-site scripting XSS vulnerability in index.php in the WordPress Responsive Preview plugin before 1.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the url parameter...

CVE-2014-4593

CVE-2014-4593 is a cross-site scripting (XSS) vulnerability in the WP Plugin Manager (WP Plugin Manager) plugin for WordPress, specifically in wp-plugins-net/index.php up to version 1.6.4.b. The flaw allows remote attackers to inject arbitrary web script or HTML via the filter parameter. Connecte...

CVE-2014-4594: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in the WordPress Responsive Preview plugin before 1.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the url parameter...

CVE-2014-4593: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in wp-plugins-net/index.php in the WP Plugin Manager wppm plugin 1.6.4.b and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filter parameter...

PT-2014-6006

Name of the Vulnerable Software and Affected Versions WP Plugin Manager wppm plugin version 1.6.4.b and earlier Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the filter parameter in the wp-plugins-net/index.php file. This could...

PT-2014-6007

Name of the Vulnerable Software and Affected Versions WordPress Responsive Preview plugin version 1.1 and earlier Description A cross-site scripting issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the url parameter in the index.php file...

PT-2014-5984

Name of the Vulnerable Software and Affected Versions VideoWhisper Video Presentation plugin versions prior to 3.31 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. Specifically,...

CVE-2014-4169: BoltWire index.php file upload

BoltWire (vulnerable through /index.php) suffers from improper validation of uploaded filenames, allowing an attacker with valid credentials to upload a PHP file and rename it (e.g., file.php) to achieve remote code execution and complete compromise of the web application. Descriptions from 1337D...

CVE-2014-4585: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the WP-FaceThumb plugin possibly 1.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the ajaxurl parameter to index.php...