CVE-2010-4612: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in index.php in Hycus CMS 1.0.3, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 username and 2 usremail parameters to user/1/hregister.html, 3 usremail parameter to user/1/hlogin.html, 4 useremail paramete...

PT-2010-5575

Name of the Vulnerable Software and Affected Versions Html-edit CMS version 3.1.8 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the nuser parameter in a "registrate" action. The endpoint involved is not explicitly specified, but it is relate...

CVE-2010-4617: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the JotLoader comjotloader component 2.2.1 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the section parameter to index.php...

CVE-2010-4613: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in Hycus CMS 1.0.3 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the site parameter to 1 index.php and 2 admin.php...

CVE-2010-4610: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in Html-edit CMS 3.1.8 allows remote attackers to inject arbitrary web script or HTML via the error parameter...

Tunngavik CMS SQL Injection / Cross Site Scripting

======================================================= Tunngavik CMS Exploit database separated by exploit 3 3 type local, remote, DoS, etc. 3 7 7 1 + Site : 1337db.com 1 3 + Support e-mail : submitat1337db.com 3 3 3 7 7 1 I'm KnocKout 1337 Member from 1337 DataBase 1 3 3 3 3...

Joomla Lyftenbloggie Cross Site Scripting

Joomla Component comlyftenbloggie XSS/HTML Vulnerability =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-= /\ \ /\ \ \ \ \L\ \ \ \ \ /\ \ \ \ /',\ \ /\ /\ /\ \ /'\ /' \ /'\ \ \ /\ /, \ \ \ \ \ \ \ \ \ /\ \L./\ /\ /\ / \ \ \// \ \ \ \/ \ /.\ \ \ \...

eclime index.php ref Parameter SQL Injection

The version of eclime hosted on the remote web server fails to sanitize input to the 'ref' parameter of the 'index.php' script before using it in a database query. Regardless of PHP's 'magicquotesgpc' setting, an unauthenticated remote attacker can leverage this issue to manipulate SQL queries an...

Directory traversal

Directory traversal vulnerability in includes/controller.php in Pulse CMS Basic before 1.2.9 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the p parameter to index.php...

CVE-2010-4330

Directory traversal vulnerability in includes/controller.php in Pulse CMS Basic before 1.2.9 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the p parameter to index.php...

Alguest 1.1c-patched SQL Injection

New eVuln Advisory: SQL Injection vulnerability in Alguest Summary: http://evuln.com/vulns/154/summary.html Details: http://evuln.com/vulns/154/description.html -----------Summary----------- eVuln ID: EV0154 Software: Alguest Vendor: n/a Version: 1.1c-patched Critical Level: medium Type: SQL...

PT-2010-5475

Name of the Vulnerable Software and Affected Versions DynPG CMS versions 4.1.1 through 4.2.0 Description The issue allows remote attackers to read arbitrary files due to a directory traversal vulnerability in the languages.inc.php file when magic quotes gpc is disabled. This can be exploited by...

PT-2010-5483

Name of the Vulnerable Software and Affected Versions AlGuest version 1.1c-patched Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the nome nickname, messaggio message, and li...

CVE-2010-4407: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in index.php in AlGuest 1.1c-patched allow remote attackers to inject arbitrary web script or HTML via the 1 nome nickname, 2 messaggio message, and 3 link homepage parameters...

CVE-2010-4280

Multiple SQL injection vulnerabilities in Pandora FMS before 3.1.1 allow remote authenticated users to execute arbitrary SQL commands via 1 the idgroup parameter in an operation/agentes/veragente action to ajax.php or 2 the groupid parameter in an operation/agentes/estadoagente action to index.ph...

CVE-2010-4280

Multiple SQL injection vulnerabilities in Pandora FMS before 3.1.1 allow remote authenticated users to execute arbitrary SQL commands via 1 the idgroup parameter in an operation/agentes/veragente action to ajax.php or 2 the groupid parameter in an operation/agentes/estadoagente action to index.ph...

PT-2010-5398

Name of the Vulnerable Software and Affected Versions Pandora FMS versions prior to 3.1.1 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This can be achieved via two specific API endpoints: "operation/agentes/ver agente" in "ajax.php" using the id group...

CVE-2010-4280: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Pandora FMS before 3.1.1 allow remote authenticated users to execute arbitrary SQL commands via 1 the idgroup parameter in an operation/agentes/veragente action to ajax.php or 2 the groupid parameter in an operation/agentes/estadoagente action to index.ph...

PT-2010-5397

Name of the Vulnerable Software and Affected Versions Pandora FMS versions 3.1 and earlier Description The issue allows remote attackers to bypass authentication. This is achieved by sending a request to "index.php" with "admin" in the loginhash user parameter, in conjunction with the md5 hash of...

CVE-2010-4360

CVE-2010-4360 refers to multiple SQL injection vulnerabilities in Jurpopage 0.2.0, exploitable via the (1) note and (2) pg parameters in index.php, per the initial description and corroborating Red Hat entries. The connected documents confirm the same vulnerability pattern and provide no details ...