PT-2012-5812

Name of the Vulnerable Software and Affected Versions OSClass versions prior to 2.3.5 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the id parameter in an enable category action to "index.php". Recommendations For versions prior to...

PT-2012-5811

Name of the Vulnerable Software and Affected Versions OSClass versions prior to 2.3.5 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the id parameter in a 1 edit category post or 2 enable category action to "index.php". Recommendations Fo...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the getParam function in oc-includes/osclass/core/Params.php in OSClass before 2.3.5 allow remote attackers to inject arbitrary web script or HTML via the 1 sCity, 2 sPattern, 3 sPriceMax, and 4 sPriceMin parameters in a search action to...

Sql injection

Multiple SQL injection vulnerabilities in OSClass before 2.3.5 allow remote attackers to execute arbitrary SQL commands via the sCategory parameter to index.php, which is not properly handled by the 1 oscsearchcategoryid function in oc-includes/osclass/helpers/hSearch.php and 2 findBySlug functio...

CVE-2012-0973

Multiple SQL injection vulnerabilities in OSClass before 2.3.5 allow remote attackers to execute arbitrary SQL commands via the sCategory parameter to index.php, which is not properly handled by the 1 oscsearchcategoryid function in oc-includes/osclass/helpers/hSearch.php and 2 findBySlug functio...

CVE-2012-0973

Multiple SQL injection vulnerabilities in OSClass before 2.3.5 allow remote attackers to execute arbitrary SQL commands via the sCategory parameter to index.php, which is not properly handled by the 1 oscsearchcategoryid function in oc-includes/osclass/helpers/hSearch.php and 2 findBySlug functio...

CVE-2012-0974

Multiple cross-site scripting XSS vulnerabilities in the getParam function in oc-includes/osclass/core/Params.php in OSClass before 2.3.5 allow remote attackers to inject arbitrary web script or HTML via the 1 sCity, 2 sPattern, 3 sPriceMax, and 4 sPriceMin parameters in a search action to...

CVE-2012-0973: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in OSClass before 2.3.5 allow remote attackers to execute arbitrary SQL commands via the sCategory parameter to index.php, which is not properly handled by the 1 oscsearchcategoryid function in oc-includes/osclass/helpers/hSearch.php and 2 findBySlug functio...

PT-2012-2979

Name of the Vulnerable Software and Affected Versions OSClass versions prior to 2.3.5 Description The issue allows remote attackers to execute arbitrary SQL commands. This is possible due to improper handling of the sCategory parameter to "index.php" by the 1 osc search category id function in...

PT-2012-2980

Name of the Vulnerable Software and Affected Versions OSClass versions prior to 2.3.5 Description The issue concerns multiple cross-site scripting XSS vulnerabilities in the getParam function. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via specific...

CVE-2012-5105

CVE-2012-5105 affects SQLiteManager 1.2.4 and involves multiple cross-site scripting (XSS) vulnerabilities. Vulnerability details from connected sources show that remote attackers can inject arbitrary web script or HTML via the dbsel parameter to main.php or index.php, or via the nsextt parameter...

CVE-2011-5193: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in vendors/samswhois/samswhois.inc.php in the Whois Search plugin 1.4.2.3 for WordPress, when the WHOIS widget is enabled, allows remote attackers to inject arbitrary web script or HTML via the domain parameter to index.php, a different vulnerability than...

CVE-2012-5105: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in SQLiteManager 1.2.4 allow remote attackers to inject arbitrary web script or HTML via the dbsel parameter to 1 main.php or 2 index.php; or 3 nsextt parameter to index.php...

PT-2012-2170

Name of the Vulnerable Software and Affected Versions Whois Search plugin version 1.4.2.3 Description The issue is a cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary web script or HTML via the domain parameter to "index.php" when the WHOIS widget is enabled...

Ez Cart - SQL Injection Vulnerability

Exploit for php platform in category web applications 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 +...

PT-2012-5774

Name of the Vulnerable Software and Affected Versions SQLiteManager version 1.2.4 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the dbsel parameter to "main.php" or "index.php", or the nsextt parameter to "index.php". Recommendation...

CVE-2011-5190

Multiple cross-site scripting XSS vulnerabilities in Social Book Facebook Clone 2010 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO parameter to 1 signup.php, 2 lostpass.php, 3 login.php, 4 index.php, 5 helptos.php, 6 helpcontact.php, or 7 help.php...

Sql injection

Multiple SQL injection vulnerabilities in OrderSys 1.6.4 and earlier allow remote attackers to execute arbitrary SQL commands via the whereclause parameter to 1 index.php, 2 indexlong.php, or 3 indexshort.php in ordering/interfacecreator/...

CVE-2011-5183

Multiple SQL injection vulnerabilities in OrderSys 1.6.4 and earlier allow remote attackers to execute arbitrary SQL commands via the whereclause parameter to 1 index.php, 2 indexlong.php, or 3 indexshort.php in ordering/interfacecreator/...

CVE-2011-5190: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Social Book Facebook Clone 2010 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO parameter to 1 signup.php, 2 lostpass.php, 3 login.php, 4 index.php, 5 helptos.php, 6 helpcontact.php, or 7 help.php...