FUEL CMS SQL Injection Vulnerability

FUEL CMS is a content management system based on CodeIgniter. FUEL CMS 1.4.1 suffers from a SQL injection vulnerability that can be exploited by an attacker via the layout, published or searchterm parameters of pages/items...

CVE-2018-16762

FUEL CMS 1.4.1 allows SQL Injection via the layout, published, or searchterm parameter to pages/items...

Design/Logic Flaw

Frog CMS 0.9.5 has XSS via the admin/?/layout/edit layoutname parameter, aka Edit Layout...

CVE-2013-4888

Cross-site scripting XSS vulnerability in index.php in Digital Signage Xibo 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the layout parameter in the layout page...

CVE-2013-4888

Cross-site scripting XSS vulnerability in index.php in Digital Signage Xibo 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the layout parameter in the layout page...

Cross site scripting

Cross-site scripting XSS vulnerability in index.php in Digital Signage Xibo 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the layout parameter in the layout page...

CVE-2013-4888

CVE-2013-4888 (Digital Signage Xibo 1.4.2) is a documented XSS in index.php via the layout parameter on the layout page; CVE-2013-4889 describes CSRF that can hijack admin actions (e.g., AddUser) and, as noted, can enable XSS through the same page. Exploitation details are present (e.g., CSRF exp...

CVE-2013-4888

Cross-site scripting XSS vulnerability in index.php in Digital Signage Xibo 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the layout parameter in the layout page...

PT-2014-2877

Name of the Vulnerable Software and Affected Versions Digital Signage Xibo version 1.4.2 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the layout parameter in the layout page. This could potentially lead to unauthorized...

Directory traversal

Directory traversal vulnerability in index.php in SkaDate Dating allows remote attackers to read arbitrary files via a .. dot dot in the layout parameter...