en.barbar.com.hk XSS vulnerability

Vulnerable URL: http://en.barbar.com.hk/eng/memberlogin.asp?msg="please+login+first.=/bbs/posttopic.asp?c=10=6 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 21.12.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculat...

PT-2017-13614

Name of the Vulnerable Software and Affected Versions AspCMS version 2.7.2 Description The issue allows remote authenticated users to read arbitrary order information. This is achieved by modifying the OrderNo parameter in the 'member/Orderinfo.asp' page. Recommendations For AspCMS version 2.7.2,...

CVE-2017-14653: Exposure of Sensitive Information to an Unauthorized Actor

member/Orderinfo.asp in ASP4CMS AspCMS 2.7.2 allows remote authenticated users to read arbitrary order information via a modified OrderNo parameter...

CVE-2017-14616

An FBX-5312 issue was discovered in WatchGuard Fireware before 12.0. If a login attempt is made in the XML-RPC interface with an XML message containing an empty member element, the wgagent crashes, logging out any user with a session opened in the UI. By continuously executing the failed login...

SQL Injection Vulnerability in State Micro CMS Member Center

State Micro CMS is one of the mainstream CMS systems in China, and is also the largest open source platform provider in the field of PHP in Southern China. A SQL injection vulnerability exists in the member center of State Micro CMS. The vulnerability is due to the failure of the system to...

WordPress add-edit-delete-listing-for-member-module SQL Injection Vulnerability

WordPress add-edit-delete-listing-for-member-module is a WordPress-specific plugin for adding, editing and deleting operations on member listings. A SQL injection vulnerability exists in WordPress add-edit-delete-listing-for-member-module version 1.0, which stems from the program failing to filte...

PT-2017-11014

Name of the Vulnerable Software and Affected Versions add-edit-delete-listing-for-member-module version 1.0 Description The issue arises from the plugin author's failure to sanitize user-supplied input via the $act variable before passing it into an SQL statement, potentially leading to SQL...

CVE-2017-1002025: Improper Neutralization of Special Elements used in an SQL Command

Vulnerability in wordpress plugin add-edit-delete-listing-for-member-module v1.0, The plugin author does not sanitize user supplied input via $act before passing it into an SQL statement...

brunswickcountyeconomics.com XSS vulnerability

Vulnerable URL: http://brunswickcountyeconomics.com/member/login.php?msg=Business Analyst Details: Description| Value ---|--- Patched:| No Latest check for patch:| 12.12.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status...

clarksvillepartnershipdata.com XSS vulnerability

Vulnerable URL: http://clarksvillepartnershipdata.com/member/login.php?msg=Business Analyst Details: Description| Value ---|--- Patched:| No Latest check for patch:| 12.12.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website...

WordPress Ultimate Member Plugin < 1.3.29 XSS Vulnerability

The WordPress plugin Copyright C 2017 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the...

CVE-2015-8354

Cross-site scripting XSS vulnerability in the Ultimate Member WordPress plugin before 1.3.29 for WordPress allows remote attackers to inject arbitrary web script or HTML via the refer parameter to wp-admin/users.php...

Cross site scripting

Cross-site scripting XSS vulnerability in the Ultimate Member WordPress plugin before 1.3.29 for WordPress allows remote attackers to inject arbitrary web script or HTML via the refer parameter to wp-admin/users.php...

CVE-2015-8354

CVE-2015-8354 affects the WordPress Ultimate Member plugin (versions prior to 1.3.29). The root cause is lack of input filtering for the _refer parameter in wp-admin/users.php when update=confirm_delete, enabling an unauthenticated attacker to craft a link that executes arbitrary HTML/script in t...

PT-2017-7403

Name of the Vulnerable Software and Affected Versions Ultimate Member WordPress plugin versions prior to 1.3.29 Description The issue is related to a cross-site scripting XSS vulnerability. This allows remote attackers to inject arbitrary web script or HTML via the refer parameter to...

CVE-2015-8354: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Ultimate Member WordPress plugin before 1.3.29 for WordPress allows remote attackers to inject arbitrary web script or HTML via the refer parameter to wp-admin/users.php...

DEDECMS member center code submit defects can getshell

Preface : dedecms this year to update a lot of patches,the present article selected 20170315 patch for learning and research. Body: From the official website to download DEDECMS 20170315 patch using DIFF comparison tools for comparison: See the Red part, the servermsg1 variables appearing in dede...

dayrui FineCms 'out' function cross-site scripting vulnerability

dayrui FineCms is China Tianrui dayrui program design team released a set of content management system CMS using MVC architecture and PDO database interface development. A cross-site scripting vulnerability exists in the 'out' function of the controllers/member/Login.php file in version 5.0.11 of...

CVE-2017-14194

The CVE-2017-14194 entry concerns dayrui FineCms version 5.0.11, where the out function in controllers/member/Login.php is reported to have an XSS vulnerability related to the Referer HTTP header in Internet Explorer. Multiple connected records (NVD, Red Hat, CNVD, CVE list mirrors, and regional ...

PT-2017-13295

Name of the Vulnerable Software and Affected Versions FineCms version 5.0.11 Description The issue is related to the oauth function in the controllers/member/api.php file, which has an XSS vulnerability concerning the Referer HTTP header, specifically with Internet Explorer. Recommendations For...