CVE-2012-1795: Improper Neutralization of Special Elements used in an OS Command

webglimpse.cgi in Webglimpse before 2.20.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the query parameter, as exploited in the wild in March 2012...

CVE-2010-4966

Cross-site scripting XSS vulnerability in default.asp in ATCOM Netvolution allows remote attackers to inject arbitrary web script or HTML via the query parameter in a Search action...

CVE-2010-4966

Cross-site scripting XSS vulnerability in default.asp in ATCOM Netvolution allows remote attackers to inject arbitrary web script or HTML via the query parameter in a Search action...

CVE-2010-4932

Cross-site scripting XSS vulnerability in search.php in Entrans before 0.3.3 allows remote attackers to inject arbitrary web script or HTML via the query parameter...

CVE-2010-4932: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in search.php in Entrans before 0.3.3 allows remote attackers to inject arbitrary web script or HTML via the query parameter...

Unfixed XSS vulnerability at ccit.mines.edu

Security researcher p0pc0rn, has submitted on 07/01/2011 a cross-site-scripting XSS vulnerability affecting ccit.mines.edu, which at the time of submission ranked 64368 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 09/12/2011. It is currently...

Unfixed XSS vulnerability at www.one-stop-china.com

Security researcher jjbutler88, has submitted on 12/06/2010 a cross-site-scripting XSS vulnerability affecting www.one-stop-china.com, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 18/12/2011. It is...

Unfixed XSS vulnerability at www.thefind.com

Security researcher khameli, has submitted on 31/05/2010 a cross-site-scripting XSS vulnerability affecting www.thefind.com, which at the time of submission ranked 1348 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 06/07/2010. It is currently...

JBossEAP status servlet info leak

Red Hat JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 allows remote attackers to obtain sensitive information about "deployed web contexts" via a request to the status servlet, as demonstrated by a full=true query string. NOTE: this...

JBossEAP status servlet info leak

Red Hat JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 allows remote attackers to obtain sensitive information about "deployed web contexts" via a request to the status servlet, as demonstrated by a full=true query string. NOTE: this...

CVE-2010-0614

SQL injection vulnerability in ajax.php in evalSMSI 2.1.03 allows remote attackers to execute arbitrary SQL commands via the query parameter in the 1 question action, and possibly the 2 subpar or 3 numquest actions...

Sql injection

SQL injection vulnerability in ajax.php in evalSMSI 2.1.03 allows remote attackers to execute arbitrary SQL commands via the query parameter in the 1 question action, and possibly the 2 subpar or 3 numquest actions...

CVE-2010-0614: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in ajax.php in evalSMSI 2.1.03 allows remote attackers to execute arbitrary SQL commands via the query parameter in the 1 question action, and possibly the 2 subpar or 3 numquest actions...

phpGroupWare多个输入验证漏洞

BUGTRAQ ID: 35761 CVE ID: CVE-2009-4414,CVE-2009-4415,CVE-2009-4416 phpGroupWare是一个用PHP编写的多用户的网络组件，为开发其他程序提供了一个API。 phpGroupWare的多个组件中存在输入验证错误，远程攻击者可以通过提交恶意请求泄露敏感信息、执行跨站脚本或SQL注入攻击。 1 没有正确地验证传送给csvfile参数的输入便在addressbook/csvimport.php中使用，这可能导致在受影响系统上读取任意文件的内容。 2...

Unfixed XSS vulnerability at prati.ba

Security researcher Ravac, has submitted on 25/10/2009 a cross-site-scripting XSS vulnerability affecting prati.ba, which at the time of submission ranked 577552 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 07/07/2010. It is currently unfixe...

CVE-2009-3327: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in WX-Guestbook 1.1.208 allow remote attackers to execute arbitrary SQL commands via the 1 QUERY parameter to search.php and 2 USERNAME parameter to login.php. NOTE: some of these details are obtained from third party information...

Sql injection

SQL injection vulnerability in the UnbDbEncode function in unblib/database.lib.php in Unclassified NewsBoard UNB 1.6.4 allows remote attackers to execute arbitrary SQL commands via the Query parameter in a search action to forum.php, a different vector than CVE-2005-3686...

CVE-2009-1947: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the UnbDbEncode function in unblib/database.lib.php in Unclassified NewsBoard UNB 1.6.4 allows remote attackers to execute arbitrary SQL commands via the Query parameter in a search action to forum.php, a different vector than CVE-2005-3686...

CVE-2009-1367

Cross-site scripting XSS vulnerability in index.php in moziloCMS 1.11 allows remote attackers to inject arbitrary web script or HTML via the query parameter in search action, a different issue than CVE-2008-6127.2a...

Cross site scripting

Cross-site scripting XSS vulnerability in the search feature in XMLPortal 3.0 allows remote attackers to inject arbitrary web script or HTML via the query parameter...