apus.edu XSS vulnerability

Open Bug Bounty ID: OBB-457119 Description| Value ---|--- Affected Website:| apus.edu Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Sheet...

Posty 1.0 SQL Injection

======================================================== Posty SQL injection Authentication bypass Description : an attacker is able to inject malicious sql query to bypass the login page and login as normal user Proof of Concept : - http://localhost/login.php set username and password = PCS00442...

PT-2016-7433 · Moodle · Moodle

Name of the Vulnerable Software and Affected Versions: Moodle version 3.1.2 Description: The issue allows remote attackers to obtain sensitive information via unspecified vectors, related to a SQL Injection issue affecting the Administration panel function in the installation process component. T...

CVE-2016-7405

The qstr method in the PDO driver in the ADOdb Library for PHP before 5.x before 5.20.7 might allow remote attackers to conduct SQL injection attacks via vectors related to incorrect quoting...

MGASA-2016-0291 Updated phpmyadmin packages fix security vulnerability

In phpMyAdmin before 4.4.15.8, the decryption of the username/password is vulnerable to a padding oracle attack. The can allow an attacker who has access to a user's browser cookie file to decrypt the username and password. Also, the same initialization vector IV is used to hash the username and...

iUSB v1.2 iOS - Arbitrary Code Execution Vulnerability

Document Title: =============== iUSB v1.2 iOS - Arbitrary Code Execution Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1374 Release Date: ============= 2014-12-10 Vulnerability Laboratory ID VL-ID: ==================================== 137...

UBUNTU-CVE-2014-3704

The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys...

Ecomat CMS Remote SQL Injection Vulnerability

No description provided by source. Vulnerability ID: HTB22390 Reference: http://www.htbridge.ch/advisory/sqlinjectionvulnerabilityinecomatcms.html Product: Ecomat CMS Vendor: Codefabrik GmbH Vulnerable Version: 5.0 and Probably Prior Versions Vendor Notification: 18 May 2010 Vulnerability Type: S...

GV32-CMS Code of audit records-vulnerability warning-the black bar safety net

Now the cms most is mvc architecture i.e. model+view+cotroll the. Receiving and processing the parameters in the c layer, with database interaction is in the m layer, the page showed in the v layer. Structured can be better for auditing. Here I mainly find thatsql injectionvulnerabilities...

ECShop V2. 7. 3 GBK release1106 injection 0day and fix-vulnerability warning-the black bar safety net

C0deplay Team j8g Look at the code / Modify personal information / elseif $action == ‘acteditprofile’ the includeonceROOTPATH . ‘includes/libtransaction.php’; $birthday = trim$POST'birthdayYear' .’-’. trim$POST'birthdayMonth' .’-’. trim$POST'birthdayDay'; $email = trim$POST'email'; $other'msn' =...

DEBIAN-CVE-2011-3130

wp-includes/taxonomy.php in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors related to "Taxonomy query hardening," possibly involving SQL injection...

PHP Competition System 0.84 SQL Injection

Viva IslaM Viva IslaM Remote SQL Injection Vulnerability showmatchs.php competition PHP Competition System BETA = V0.84 http://phpcompet.free.fr/ http://phpcompet.free.fr/downloaden.html AuTh0r : Mr.SQL H0ME : WwW.55a.NeT Email : [email protected] -: Exploite :-...

CVE-2008-5621

Cross-site request forgery CSRF vulnerability in phpMyAdmin 2.11.x before 2.11.9.4 and 3.x before 3.1.1.0 allows remote attackers to perform unauthorized actions as the administrator via a link or IMG tag to tblstructure.php with a modified table parameter. NOTE: other unspecified pages are also...

ACCESS advanced injection-vulnerability warning-the black bar safety net

Now we in thescript injectionattack technique,commonly used techniques to score a lot of kinds,the most common is the use of subqueries or is a Union a Union query to get some special table of contents,such as Admin,Log table etc., this is a pure database attack,and MSSQL Server method is more...

phpcms injection March New Year 0day-vulnerability warning-the black bar safety net

Affected versions: 2007SP5 SP6 Vulnerability file:/formguide/include/tag.func.php Author: backerhack small cockroaches Sources of information: the zero Client Network Security www.0kee.com I wish the National female compatriots happy holidays, concerned about the health of women... “she is good, ...

20/20 auto gallery [ multiples injection sql ]

vendor site:http://www.2020autogallery.com/ product:20/20 auto gallery bug:injection sql global risk:high injection sql get : http://site.com/vehiclelistings.asp?vehicleID='sql http://site.com/vehiclelistings.asp?categoryIDlist='sql http://site.com/vehiclelistings.asp?saletype='sql...

CVE-2005-2148

Cacti 0.8.6e and earlier does not perform proper input validation to protect against common attacks, which allows remote attackers to execute arbitrary commands or SQL by sending a legitimate value in a POST request or cookie, then specifying the attack string in the URL, which causes the...

CVE-2005-1824

The sqlescapestring function in auth/sql.c for the mailutils SQL authentication module does not properly quote the "" backslash character, which is used as an escape character and makes the module vulnerable to SQL injection attacks...

CitrusDB 0.3.6 - 'importcc.php' Arbitrary Database Injection

source: https://www.securityfocus.com/bid/12557/info CitrusDB is reportedly affected by an access validation vulnerability during the upload of CSV files. Exploitation of this issue could result in path disclosure or SQL injection. The issue exists because the application fails to verify user...

phpGroupWare 0.9.x - viewticket_details.php?ticket_id Cross-Site Scripting

phpGroupWare 0.9.x - viewticketdetails.php?ticketid Cross-Site Scripting source: https://www.securityfocus.com/bid/11952/info Reportedly PHPGroupWare contains multiple input validation vulnerabilities; it is prone to multiple SQL injection and cross-site scripting issues. These issues are all due...