Hotel Booking Portal v0.1 Multiple Vulnerabilities

Exploit for php platform in category web applications ----------------------------------------------------------- / | | | | | | | | | | | | | | | | | / |/ |/ \ | | || | || | | | | / | ||\,|,||| ----------------------------------------------------------- Hotel Booking Portal v0.1 Multiple...

InterPhoto Image Gallery 2.5.1 Cross Site Scripting

HTTPCS Advisory : HTTPCS67 Product : InterPhoto Image Gallery Version : 2.5.1 Date : 2012-08-07 Criticality level : Less Critical Description : A vulnerability has been discovered in InterPhoto Image Gallery, which can be exploited by malicious people to conduct cross-site scripting attacks. Inpu...

Symantec Web Gateway 5.0.2.18 pbcontrol.php Command Injection

This module exploits a command injection vulnerability found in Symantec Web Gateway's HTTP service. While handling the filename parameter, the Spywall API does not do any filtering before passing it to an exec call in proxyfile, thus results in remote code execution under the context of the web...

CVE-2012-3999: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/login.php in Sticky Notes 0.3.09062012.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the username parameter...

Multiple vulnerabilities in osCmax

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in osCmax, which can be exploited to perform SQL Injection and Cross-Site Scripting XSS attacks. 1 Multiple Cross-Site Scripting XSS in osCmax: CVE-2012-1664 1.1 Input passed via the "username" POST parameter to...

Open redirect

Multiple open redirect vulnerabilities in CubeCart 3.0.20 and earlier allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the 1 r parameter to switch.php or 2 goto parameter to admin/login.php...

CVE-2012-1224: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in system/classes/login.php in ContentLion Alpha 1.3 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO...

CVE-2012-0865: Improper Input Validation

Multiple open redirect vulnerabilities in CubeCart 3.0.20 and earlier allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the 1 r parameter to switch.php or 2 goto parameter to admin/login.php...

CVE-2012-1020

CVE-2012-1020 affects NexorONE Online Banking: XSS in login.php where an attacker can inject arbitrary script/HTML by supplying (1) visitor_language to register.php or (2) message parameter. Public records (NVD, CVE List, PRION) confirm the vulnerability across multiple references, with the attac...

CVE-2012-1020: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in login.php in NexorONE Online Banking allow remote attackers to inject arbitrary web script or HTML via the 1 visitorlanguage parameter to register.php or 2 message parameter...

XRayCMS 1.1.1 - SQL Injection

Exploit Title: XRayCMS 1.1.1 SQL Injection Vulnerability Date: 2/5/2012 Author: chap0 Software Link: http://sourceforge.net/projects/xraycms/files/latest/download Version: 1.1.1 Tested on: Ubuntu XRay CMS is vulnerable to a SQL Injection attack which allows authentication bypass into the admins...

CVE-2012-0932

CVE-2012-0932 concerns a cross-site scripting (XSS) vulnerability in Lead Capture Page System’s admin/login.php, exploitable via the message parameter. The issue allows remote attackers to inject arbitrary web script or HTML, as documented in multiple sources (NVD, OpenVAS, CVE listings). The rel...

CVE-2012-0932: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/login.php in Lead Capture Page System allows remote attackers to inject arbitrary web script or HTML via the message parameter...

Lead Capture - 'login.php' Script Cross-Site Scripting

source: https://www.securityfocus.com/bid/51785/info Lead Capture is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the conte...

Lead Capture - login.php Script Cross-Site Scripting

Lead Capture - login.php Script Cross-Site Scripting source: https://www.securityfocus.com/bid/51785/info Lead Capture is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script cod...

Limny 3.0.1 - 'login.php' Script Cross-Site Scripting

source: https://www.securityfocus.com/bid/51261/info Limny is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of t...

Limny 3.0.1 - login.php Script Cross-Site Scripting

Limny 3.0.1 - login.php Script Cross-Site Scripting source: https://www.securityfocus.com/bid/51261/info Limny is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the...

CVE-2011-5039

Multiple SQL injection vulnerabilities in Infoproject Biznis Heroj allow remote attackers to execute arbitrary SQL commands via the 1 username and 2 password parameters to login.php, 3 the filter parameter to widget.dokumentilista.php, and 4 the finnalogid parameter to nalozinaslov.php...

CVE-2011-5039: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Infoproject Biznis Heroj allow remote attackers to execute arbitrary SQL commands via the 1 username and 2 password parameters to login.php, 3 the filter parameter to widget.dokumentilista.php, and 4 the finnalogid parameter to nalozinaslov.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Wuzly 2.0 allow remote attackers to inject arbitrary web script or HTML via the Referer header to 1 admin/login.php and 2 admin/404.php; the 3 q parameter to search.php; the 4 themename parameter to themesettings.php, 5 extensionname parameter ...