CVE-2017-15374

Shopware v5.2.5 - v5.3 is vulnerable to cross site scripting in the customer and order section of the content management system backend modules. Remote attackers are able to inject malicious script code into the firstname, lastname, or order input fields to provoke persistent execution in the...

CVE-2017-15374: Improper Neutralization of Input During Web Page Generation

Shopware v5.2.5 - v5.3 is vulnerable to cross site scripting in the customer and order section of the content management system backend modules. Remote attackers are able to inject malicious script code into the firstname, lastname, or order input fields to provoke persistent execution in the...

Zoll ePCR 2.6.4 Script Insertion

Document Title: =============== Zoll ePCR v2.6.4 iOS - Multiple Persistent Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1882 Release Date: ============= 2016-08-01 Vulnerability Laboratory ID VL-ID: ====================================...

Bugcrowd Bug Bounty #7 - Persistent Web Vulnerability

Document Title: =============== Bugcrowd Bug Bounty 7 - Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1830 ID: b40f63ed19074014df808599e44684f6a18bb6f4f51cf21948ef78df2f56c13b Release Date: ============= 2016-05-10...

CVE-2016-1912

Multiple cross-site scripting XSS vulnerabilities in Dolibarr ERP/CRM 3.8.3 allow remote authenticated users to inject arbitrary web script or HTML via the 1 lastname, 2 firstname, 3 email, 4 job, or 5 signature parameter to htdocs/user/card.php...

PT-2016-4918

Name of the Vulnerable Software and Affected Versions Dolibarr ERP/CRM version 3.8.3 Description The issue allows remote authenticated users to inject arbitrary web script or HTML via specific parameters to the "htdocs/user/card.php" endpoint, including the lastname, firstname, email, job, or...

BlinkSale Bug Bounty #1 - Encode & Validation Vulnerability

Document Title: =============== BlinkSale Bug Bounty 1 - Encode & Validation Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1416 Release Date: ============= 2015-02-06 Vulnerability Laboratory ID VL-ID: ====================================...

PT-2014-4985

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 6.1.2 CE GA3, 6.1.X EE, and 6.2.X EE Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via specific...

CVE-2014-2526: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in BarracudaDrive before 6.7 allow remote attackers to inject arbitrary web script or HTML via the 1 sForumName or 2 sDescription parameter to Forum/manage/ForumManager.lsp; 3 sHint, 4 sWord, or 5 nId parameter to Forum/manage/hangman.lsp; 6 user...

SilverStripe Framework CMS 3.0.5 - Multiple Web Vulnerabilities

Title: ====== SilverStripe Framework CMS 3.0.5 - Multiple Vulnerabilities Date: ===== 2013-09-23 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1084 VL-ID: ===== 1084 Common Vulnerability Scoring System: ==================================== 3.9 Introduction:...

WebAssist PowerCMS PHP - Multiple Web Vulnerabilities

Document Title: =============== WebAssist PowerCMS PHP - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1098 Release Date: ============= 2013-09-27 Vulnerability Laboratory ID VL-ID: ==================================== 1098...

CVE-2012-6556

Multiple cross-site scripting XSS vulnerabilities in the FirstLastNames plugin 1.1.1 for Vanilla Forums allow remote attackers to inject arbitrary web script or HTML via the 1 User/FirstName or 2 User/LastName parameter to the edit user page. NOTE: some of these details are obtained from third...

PT-2013-2010

Name of the Vulnerable Software and Affected Versions FirstLastNames plugin version 1.1.1 for Vanilla Forums Description The issue allows remote attackers to inject arbitrary web script or HTML via the User/FirstName or User/LastName parameter to the edit user page, potentially leading to...

CVE-2012-6556: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the FirstLastNames plugin 1.1.1 for Vanilla Forums allow remote attackers to inject arbitrary web script or HTML via the 1 User/FirstName or 2 User/LastName parameter to the edit user page. NOTE: some of these details are obtained from third...

Sql injection

SQL injection vulnerability in mainbigware43.php in Bigware Shop before 2.1.5 allows remote attackers to execute arbitrary SQL commands via the lastname parameter in a process action...

CVE-2012-5317: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in mainbigware43.php in Bigware Shop before 2.1.5 allows remote attackers to execute arbitrary SQL commands via the lastname parameter in a process action...

PT-2012-5916

Name of the Vulnerable Software and Affected Versions Bigware Shop versions prior to 2.1.5 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the lastname parameter in a process action, specifically targeting the main bigware 43.php file...

eFront Educational v3.6.11 - Multiple Web Vulnerabilities

Document Title: =============== eFront Educational v3.6.11 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=666 Release Date: ============= 2012-08-03 Vulnerability Laboratory ID VL-ID: ==================================== 6...

CVE-2012-1006

Multiple cross-site scripting XSS vulnerabilities in Apache Struts 2.0.14 and 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the 1 name or 2 lastName parameter to struts2-showcase/person/editPerson.action, or the 3 clientName parameter to struts2-rest-showcase/orders...

PT-2012-1242

Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.0.14 through 2.2.3 Description The issue allows remote attackers to inject arbitrary web script or HTML via the name or lastName parameter to "struts2-showcase/person/editPerson.action", or the clientName parameter to...