PT-2019-7552

Name of the Vulnerable Software and Affected Versions Kliqqi version 3.0.0.5 Description The issue allows for CSRF with resultant Arbitrary File Upload. This is possible because the "module.php?module=upload" endpoint can be used to configure the uploading of .php files, and then the...

CVE-2016-10756: Cross-Site Request Forgery (CSRF)

Kliqqi 3.0.0.5 allows CSRF with resultant Arbitrary File Upload because module.php?module=upload can be used to configure the uploading of .php files, and then modules/upload/uploadmain.php can be used for the upload itself...

PT-2018-1121

Name of the Vulnerable Software and Affected Versions U.motion Builder versions prior to 1.3.4 Description The issue is due to insufficient handling of the update file request parameter on the update module.php script in the U.motion Builder software. This allows a remote, authenticated attacker ...

VisualShapers EZContents 1.4/2.0 Module.PHP Remote Command Execution Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/9396/info A problem in handling of specific types of input passed to the module.php script in VisualShapers ezContents has been discovered. Because of this, an attacker may be able to gain unauthorized access to vulnerabl...

CVE-2013-6267: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Claroline before 1.11.9 allow remote attackers to inject arbitrary web script or HTML via the 1 box parameter to messaging/messagebox.php, cidToEdit parameter to 2 adminregisteruser.php or 3 adminusercoursesettings.php in admin/, 4 moduleid...

CVE-2012-2937

Multiple SQL injection vulnerabilities in Pligg CMS before 1.2.2 allow remote attackers to execute arbitrary SQL commands via the 1 list parameter in a move action to admin/adminindex.php, 2 display parameter in a minimize action to admin/adminindex.php, 3 enabled parameter to admin/adminusers.ph...

PT-2012-4041

Name of the Vulnerable Software and Affected Versions Pligg CMS versions prior to 1.2.2 Description The issue allows remote authenticated users to include and execute arbitrary local files via a .. dot dot in the captcha parameter to "module.php". This can be exploited through cross-site request...

PT-2012-4378

Name of the Vulnerable Software and Affected Versions Pligg CMS versions prior to 1.2.2 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved through several parameters in different actions and files, including the "list" parameter in a move action ...

CVE-2012-2937: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Pligg CMS before 1.2.2 allow remote attackers to execute arbitrary SQL commands via the 1 list parameter in a move action to admin/adminindex.php, 2 display parameter in a minimize action to admin/adminindex.php, 3 enabled parameter to admin/adminusers.ph...

Pligg CMS 1.2.1 SQL注入漏洞

Bugtraq ID: 53625 Pligg CMS是一款内容管理系统。 Pligg CMS包含的admin/adminindex.php，admin/adminusers.php，module.php脚本不正确过滤用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，可获得数据库信息或控制应用系统。 0 Pligg CMS 1.2.1 厂商解决方案 Pligg CMS 1.2.2已经修复此漏洞，建议用户下载使用： http://forums.pligg.com/downloads.php?do=file&id=15...

PhpGedView module.php pgvaction Parameter Traversal Local File Inclusion

The web server hosts PhpGedView, a web-based real estate listing management application written in PHP. The version of PhpGedView installed on the remote host fails to sanitize user input to the 'pgvaction' parameter of the 'module.php' script before using it to include PHP code. Regardless of...

PT-2011-2326

Name of the Vulnerable Software and Affected Versions PhpGedView version 4.2.3 Description The issue allows remote attackers to read arbitrary files due to a directory traversal vulnerability in the module.php file when magic quotes gpc is disabled. This can be achieved by using directory travers...

CVE-2011-0405: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in module.php in PhpGedView 4.2.3 and possibly other versions, when magicquotesgpc is disabled, allows remote attackers to read arbitrary files via directory traversal sequences in the pgvaction parameter...

CVE-2010-4634

osTicket 1.6 is affected by a directory traversal vulnerability. The issue allows remote attackers to read arbitrary files by supplying .. sequences in the file parameter to module.php, a vulnerability described across CVE-2010-4634. The description notes this is a separate vector from CVE-2005-1...

PT-2010-5598

Name of the Vulnerable Software and Affected Versions osTicket version 1.6 Description A directory traversal issue allows remote attackers to read arbitrary files by using a .. dot dot in the file parameter to "module.php". This issue has been disputed by a reliable third party. Recommendations F...

CVE-2010-4634: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in osTicket 1.6 allows remote attackers to read arbitrary files via a .. dot dot in the file parameter to module.php, a different vector than CVE-2005-1439. NOTE: this issue has been disputed by a reliable third party...

Cross site scripting

Cross-site scripting XSS vulnerability in module.php in PHPFABER CMS, possibly 1.3.36, allows remote attackers to inject arbitrary web script or HTML via the mod parameter...

CVE-2009-4382

CVE-2009-4382 affects phpFaber CMS, likely in module.php, where user-supplied mod parameter enables cross-site scripting (XSS). Public records indicate PHPFaber CMS 1.3.36 is vulnerable; root cause is insufficient sanitization of input, allowing arbitrary script/HTML injection. The vulnerability ...

CVE-2009-4382: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in module.php in PHPFABER CMS, possibly 1.3.36, allows remote attackers to inject arbitrary web script or HTML via the mod parameter...

Directory traversal

module.php in ezContents 2.0.3 allows remote attackers to bypass the directory traversal protection mechanism to include and execute arbitrary local files via "....//" doubled dot dot slash sequences in the link parameter, which is not properly filtered using the strreplace function...