WordPress Register Plus Plugin <= 3.5.1 - Multiple XSS

Because of these vulnerabilities in wp-login.php, the attackers can inject arbitrary web script or HTML via the "website", "aim", "yahoo", "jabber", "firstname", "lastname", "about", "pass1", and "pass2" parameters in a register action. Solution Update the plugin...

PT-2010-5478

Name of the Vulnerable Software and Affected Versions Register Plus plugin versions 3.5.1 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML via several parameters in a register action, including firstname, lastname, website, aim, yahoo, jabber, about...

Pre Hospital Management System SQL Injection

In The Name Of GOD + Exploit Title: PRE HOSTPITAL MANAGEMENT SYSTEM SQL Bypass Vulnerability + Date: 2010-11-13 + Author : Cru3l.b0y + Software Link: http://www.preproject.com/hms.asp + Price : 750.00$ + Contact : [email protected] + Website : WwW.PenTesters.IR + Greeting: Behzad, Ahmad,...

PT-2010-5002

Name of the Vulnerable Software and Affected Versions NetArtMEDIA WebSiteAdmin affected versions not specified Description The issue allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the lng parameter of the ADMIN/login.php file...

CVE-2010-3688: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in ADMIN/login.php in NetArtMEDIA WebSiteAdmin allows remote emote attackers to include and execute arbitrary local files via directory traversal sequences in the lng parameter...

CVE-2010-3481

Multiple SQL injection vulnerabilities in login.php in ApPHP PHP MicroCMS 1.0.1, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 username and 2 password variables, possibly related to include/classes/Login.php. NOTE: some of these details are...

CVE-2010-3481

Multiple SQL injection vulnerabilities in login.php in ApPHP PHP MicroCMS 1.0.1, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 username and 2 password variables, possibly related to include/classes/Login.php. NOTE: some of these details are...

CVE-2010-3481

CVE-2010-3481 affects ApPHP PHP MicroCMS 1.0.1. It discloses multiple SQL injection vulnerabilities in login.php when magic_quotes_gpc is disabled, allowing remote attackers to potentially execute arbitrary SQL via (1) user_name and (2) password variables, possibly tied to include/classes/Login.p...

CVE-2010-3314

CVE-2010-3314 is a cross-site scripting (XSS) vulnerability in EGroupware: login.php vulnerable in EGroupware 1.4.001+.002 and 1.6.001+.002 (and EPL 9.1 pre-9.1.20100309, 9.2 pre-9.2.20100309). The lang parameter can inject arbitrary script/HTML. Affected versions include 1.6.x before 1.6.003 and...

CVE-2010-3314

Cross-site scripting XSS vulnerability in login.php in EGroupware 1.4.001+.002; 1.6.001+.002 and possibly other versions before 1.6.003; and EPL 9.1 before 9.1.20100309 and 9.2 before 9.2.20100309; allows remote attackers to inject arbitrary web script or HTML via the lang parameter...

CVE-2010-3314: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in login.php in EGroupware 1.4.001+.002; 1.6.001+.002 and possibly other versions before 1.6.003; and EPL 9.1 before 9.1.20100309 and 9.2 before 9.2.20100309; allows remote attackers to inject arbitrary web script or HTML via the lang parameter...

CVE-2010-3481: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in login.php in ApPHP PHP MicroCMS 1.0.1, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 username and 2 password variables, possibly related to include/classes/Login.php. NOTE: some of these details are...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in CruxSoftware CruxPA 2.00, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the 1 txtusername parameter to login.php, 2 todo parameter to newtodo.php, and unspecified vectors to 3 newtelephone.php and 4...

CVE-2010-2718: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in CruxSoftware CruxPA 2.00, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the 1 txtusername parameter to login.php, 2 todo parameter to newtodo.php, and unspecified vectors to 3 newtelephone.php and 4...

CVE-2010-2717: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in manager/login.php in CruxSoftware CruxCMS 3.0, and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via the txtusername parameter...

Oracle Secure Backup Administration uname Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on vulnerable installations of Oracle Secure Backup. Authentication is not required to exploit this vulnerability. The specific flaw exists in the handling of user input to the uname variable of the login.php script running on th...

CVE-2009-4933

Multiple SQL injection vulnerabilities in login.php in EZ Webitor allow remote attackers to execute arbitrary SQL commands via the 1 txtUserId Username and 2 txtPassword Password parameters. NOTE: some of these details are obtained from third party information...

CVE-2009-4933

Multiple SQL injection vulnerabilities in login.php in EZ Webitor are documented under CVE-2009-4933. The issue is triggered by unvalidated input in two parameters, txtUserId (Username) and txtPassword (Password), allowing remote attackers to execute arbitrary SQL commands. The description consis...

CVE-2009-4933: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in login.php in EZ Webitor allow remote attackers to execute arbitrary SQL commands via the 1 txtUserId Username and 2 txtPassword Password parameters. NOTE: some of these details are obtained from third party information...

Task Freak Cross Site Scripting and SQL Injection Vulnerabilities

This host is running Task Freak and is prone to Cross Site Scripting and SQL Injection vulnerabilities. OpenVAS Vulnerability Test $Id: gbtaskfreakxssnsqlinjvuln.nasl 7573 2017-10-26 09:18:50Z cfischer $ Task Freak Cross Site Scripting and SQL Injection Vulnerabilities Authors: Madhuri D Copyrigh...