Didiwiki directory traversal vulnerability

didiwiki is a Wikipedia implementation written in C by software developer Matthew Allum, which is primarily used for personal records such as notes and to-do lists. A directory traversal vulnerability exists in didiwiki's wiki.c file, which stems from the failure of the api/page/get URI to...

DEBIAN-CVE-2013-7448

Directory traversal vulnerability in wiki.c in didiwiki allows remote attackers to read arbitrary files via the page parameter to api/page/get...

CVE-2013-7448

Directory traversal vulnerability in wiki.c in didiwiki allows remote attackers to read arbitrary files via the page parameter to api/page/get...

Role Scoper WordPress Plugin Reflective Cross-Site Scripting Vulnerability

Role Scoper WordPress plugin is comprehensive access control solution that controls read and edit permissions like a CMS. Role Scoper WordPress 1.3.66 and earlier versions do not effectively filter the "objectname" HTTP GET parameter value of "/wp-admin/admin.php" when "page" is set to...

Welcart vulnerable to cross-site scripting

Overview Welcart provided by Collne Inc. is a WordPress plugin for creating shopping websites. Welcart contains a cross-site scripting CWE-79 vulnerability due to the processing of uscesreferer parameter in admin.php. Shoji Baba reported this vulnerability to IPA. JPCERT/CC coordinated with the...

SQL Injection Vulnerability in Panmicro E-office /E-mobile/flownext_page.php Parameters

Panmicro E-office is an OA product launched by Panmicro for small and medium-sized organizations. A SQL injection vulnerability exists in the Panmicro E-office /E-mobile/flownextpage.php parameter, which can be exploited by attackers to obtain sensitive information from the database...

SQL Buddy /sqlbuddy/ page parameter remote directory traversal vulnerability

SQL Buddy is a nice lightweight ajax database management tool. SQL Buddy fails to properly filter user input, allowing remote attackers to exploit a vulnerability to access arbitrary files via the 'page' parameter...

CVE-2015-2678

Multiple cross-site scripting XSS vulnerabilities in MetalGenix GeniXCMS before 0.0.2 allow remote attackers to inject arbitrary web script or HTML via the 1 cat parameter in the categories page to gxadmin/index.php or 2 page parameter to index.php...

Cross site scripting

Cross-site scripting XSS vulnerability in readme.php in the April's Super Functions Pack plugin before 1.4.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter. NOTE: some of these details are obtained from third party information...

Escapade 0.2.1 Beta Scripting Engine PAGE Parameter Path Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/8574/info Escapade is prone to a path disclosure vulnerability. It is possible to gain access to sensitive path information by issuing a request for an invalid resource, passed as a value for the PAGE parameter to the...

PT-2014-4260 · Uaepd · Uaepd Shopping Cart Script

Name of the Vulnerable Software and Affected Versions: UAEPD Shopping Cart Script affected versions not specified Description: The issue concerns SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands. This can be achieved by manipulating the cat id or p id...

Onpub CMS 1.4 & 1.5 - Multiple SQL Injection Vulnerabilities

Document Title: =============== Onpub CMS 1.4 & 1.5 - Multiple SQL Injection Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1120 Release Date: ============= 2013-10-25 Vulnerability Laboratory ID VL-ID: ==================================...

WordPress Spreadsheet Plugin <= 2.0 - Cross Site Scripting

Because of this vulnerability in codebase/spreadsheet.php, the attackers can inject arbitrary web script or HTML via the "page" parameter. Solution Update the plugin...

CVE-2011-5260

Cross-site scripting XSS vulnerability in SAP/BW/DOC/METADATA in SAP NetWeaver allows remote attackers to inject arbitrary web script or HTML via the page parameter...

Linksys WRT160N XSS / CSRF / Command Injection

Device Name: Linksys WRT160Nv2 Vendor: Linksys/Cisco ============ Device Description: ============ Best For: Delivers plenty of speed and coverage, so large groups of users can go online, transfer large files, print, and stream stored media Features: Fast Wireless-N connectivity frees you to do...

CVE-2011-4618

Cross-site scripting XSS vulnerability in advancedtext.php in Advanced Text Widget plugin before 2.0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter...

CVE-2012-6040

Cross-site scripting XSS vulnerability in users.php in File King Advanced File Management 1.4 allows remote attackers to inject arbitrary web script or HTML via the page parameter...

CVE-2012-5330

Multiple cross-site scripting XSS vulnerabilities in asaanCart 0.9 allow remote attackers to inject arbitrary web script or HTML via the 1 PATHINFO to calc.php, 2 chat.php, 3 register.php, or 4 index.php in libs/smartyajax/; or the 5 page parameter to libs/smartyajax/index.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in asaanCart 0.9 allow remote attackers to inject arbitrary web script or HTML via the 1 PATHINFO to calc.php, 2 chat.php, 3 register.php, or 4 index.php in libs/smartyajax/; or the 5 page parameter to libs/smartyajax/index.php...

CVE-2012-5330

Multiple cross-site scripting XSS vulnerabilities in asaanCart 0.9 allow remote attackers to inject arbitrary web script or HTML via the 1 PATHINFO to calc.php, 2 chat.php, 3 register.php, or 4 index.php in libs/smartyajax/; or the 5 page parameter to libs/smartyajax/index.php...