CVE-2012-1000

CVE-2012-1000: LEPTON 1.1.3 and earlier versions suffer XSS in multiple user input points. The vulnerability arises from inadequate sanitization of user-supplied data in the parameters responsible for messages and profile fields: message (admins/login/forgot/index.php), and display_name / email (...

CVE-2012-0998

LEPTON CVE-2012-0998 is a Local File Inclusion vulnerability in the account/preferences.php flow. Input passed via the language parameter is saved into the session and later used by include(), enabling an attacker to traverse directories and include local files. Affected product/version: LEPTON p...

CVE-2012-0999

CVE-2012-0999 is a SQL Injection vulnerability in LEPTON CMS, affecting the file path modules/news/rss.php. The issue arises from unsanitized input in the POST parameter group_id , enabling remote attackers to construct arbitrary SQL queries and potentially compromise the database. Affected versi...

CVE-2012-1000

Multiple cross-site scripting XSS vulnerabilities in LEPTON 1.1.3 and other versions before 1.1.4 allow remote attackers to inject arbitrary web script or HTML via the 1 message parameter to admins/login/forgot/index.php, or the 2 displayname or 3 email parameter to account/preferences.php...

PT-2012-3003

Name of the Vulnerable Software and Affected Versions LEPTON versions prior to 1.1.4 Description A directory traversal issue exists, allowing remote attackers to include and execute arbitrary files. This is achieved by using a .. dot dot in the language parameter of the account/preferences.php...

PT-2012-3004

Name of the Vulnerable Software and Affected Versions LEPTON versions prior to 1.1.4 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the group id parameter in the modules/news/rss.php file. Recommendations For versions prior to 1.1.4, update t...

PT-2012-3005

Name of the Vulnerable Software and Affected Versions LEPTON versions prior to 1.1.4 Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting XSS attacks. This can be achieved via the message parameter to...

CVE-2012-0998: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in account/preferences.php in LEPTON before 1.1.4 allows remote attackers to include and execute arbitrary files via a .. dot dot in the language parameter...

CVE-2012-0999: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in modules/news/rss.php in LEPTON before 1.1.4 allows remote attackers to execute arbitrary SQL commands via the groupid parameter...

CVE-2012-1000: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in LEPTON 1.1.3 and other versions before 1.1.4 allow remote attackers to inject arbitrary web script or HTML via the 1 message parameter to admins/login/forgot/index.php, or the 2 displayname or 3 email parameter to account/preferences.php...

LEPTON 1.1.3 SQL Injection / XSS / Local File Inclusion

Advisory ID: HTB23072 Product: LEPTON Vendor: LEPTON Project Vulnerable Versions: 1.1.3 and probably prior Tested Version: 1.1.3 Vendor Notification: 25 January 2012 Vendor Patch: 4 February 2012 Public Disclosure: 15 February 2012 Vulnerability Type: Local File Inclusion, SQL Injection, Cross Si...

LEPTON 1.1.3 SQL Injection / XSS / Local File Inclusion

Exploit for php platform in category web applications Vendor: LEPTON Project Vulnerable Versions: 1.1.3 and probably prior Tested Version: 1.1.3 Vendor Notification: 25 January 2012 Vendor Patch: 4 February 2012 Public Disclosure: 15 February 2012 Vulnerability Type: Local File Inclusion, SQL...

LEPTON 1.1.3 - Cross-Site Scripting

LEPTON 1.1.3 - Cross-Site Scripting source: https://www.securityfocus.com/bid/52026/info LEPTON is prone to multiple input-validation vulnerabilities, including: 1. A cross-site scripting vulnerability 2. An SQL-injection vulnerability 3. A local file-include vulnerability 4. Multiple...

LEPTON 1.1.3 - Cross-Site Scripting

source: https://www.securityfocus.com/bid/52026/info LEPTON is prone to multiple input-validation vulnerabilities, including: 1. A cross-site scripting vulnerability 2. An SQL-injection vulnerability 3. A local file-include vulnerability 4. Multiple HTML-injection vulnerabilities Exploiting these...

Multiple vulnerabilities in LEPTON

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in LEPTON, which can be exploited to perform Local File Inclusion, Cross Site Scripting and SQL Injection attacks. 1 Local File Inclusion in LEPTON: CVE-2012-0998 Input passed via the "language" POST parameter to...

CVE-2011-3385: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in WebsiteBaker before 2.8, as used in LEPTON and possibly other products, allows remote attackers to inject arbitrary web script or HTML via unknown vectors, a different vulnerability than CVE-2006-2307...

PT-2011-4420

Name of the Vulnerable Software and Affected Versions WebsiteBaker versions prior to 2.8 LEPTON affected versions not specified Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via unknown vectors. This is a distinct issue from previous...

WebsiteBaker vulnerable to cross-site scripting

Overview WebsiteBaker contains a cross-site scripting vulnerability. WebsiteBaker is a content management system CMS. WebsiteBaker contains a cross-site scripting vulnerability. Daiki Fukumori of Cyber Defense Institute, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the...

JVN#02134508: WebsiteBaker vulnerable to cross-site scripting

WebsiteBaker is a content management system CMS. WebsiteBaker contains a cross-site scripting vulnerability. Impact An arbitrary script may be executed on the user's web browser. Solution Upgrade the software Upgrade to Lepton CMS according to the information provided by the developer. Products...