50 matches found
CVE-2018-18075
WikidForum 2.20 has SQL Injection via the rpc.php parentpostid or numrecords parameter, or the index.php?action=search selectsort parameter...
CVE-2018-18075: Improper Neutralization of Special Elements used in an SQL Command
WikidForum 2.20 has SQL Injection via the rpc.php parentpostid or numrecords parameter, or the index.php?action=search selectsort parameter...
CVE-2017-1000065
Multiple Cross-site scripting XSS vulnerabilities in rpc.php in OpenMediaVault release 2.1 in Access Rights ManagementUsers functionality allows attackers to inject arbitrary web scripts and execute malicious scripts within an authenticated client's browser...
Cross site scripting
Multiple Cross-site scripting XSS vulnerabilities in rpc.php in OpenMediaVault release 2.1 in Access Rights ManagementUsers functionality allows attackers to inject arbitrary web scripts and execute malicious scripts within an authenticated client's browser...
CVE-2017-1000065: Improper Neutralization of Input During Web Page Generation
Multiple Cross-site scripting XSS vulnerabilities in rpc.php in OpenMediaVault release 2.1 in Access Rights ManagementUsers functionality allows attackers to inject arbitrary web scripts and execute malicious scripts within an authenticated client's browser...
EyeLock nano NXT 3.3-3.5 unauthenticated command injection vulnerabilities
/scripts/rpc.php: --- 9: if isset$REQUEST'action' 10: 11: switch$REQUEST'action' ... ... 181: case 'updatetime': 182: 183: // do something, the put our response in the response field... 184: $strDate = shellexec"rdate -s $REQUEST'timeserver' 2&1"; 185: 186: // set the hardware clock. 187:...
CVE-2013-3632: Undefined Security Weakness
The Cron service in rpc.php in OpenMediaVault allows remote authenticated users to execute cron jobs as arbitrary users and execute arbitrary commands via the username parameter...
Cerberus Helpdesk 3.2.1 Rpc.PHP Unauthorized Access Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/20598/info Cerberus Helpdesk is prone to an unauthorized-access vulnerability because the application fails to authenticate users properly, resulting in an improper-access validation. A workaround is available. An attacke...
Clipperz Password Manager Code Execution Vulnerability
Clipperz Password Manager suffers from a remote code execution vulnerability. Exploit Title : Clipperz Password Manager remote code execution vulnerability Author : Manish Kishan Tanwar Vendor : https://clipperz.is/opensource/clipperzpasswordmanager/ Download Link :...
Clipperz Password Manager - '/backend/PHP/src/setup/rpc.php' Remote Code Execution
source: https://www.securityfocus.com/bid/67498/info Clipperz Password Manager is prone to remote code-execution vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the affected application...
TomatoCart 1.1.8.6 Local File Inclusion Vulnerability
TomatoCart version 1.1.8.6 suffers from a local file inclusion vulnerability. + Author: TUNISIAN CYBER + Exploit Title: TomatoCart 1.1.8.6 Local File Inclusion Vulnerability + Date: 14-02-2014 + Category: WebApp + Tested on: KaliLinux + Vendor: http://www.tomatocart.com/ + Friendly Sites:...
CVE-2008-5963
Gravity GTD (Getting Things Done) up to version 0.4.5 is affected by an eval-injection vulnerability in library/setup/rpc.php that allows remote attackers to execute arbitrary PHP code via the objectname parameter. This CVE (CVE-2008-5963) is rated high by NVD (base score 10.0) with network attac...
CVE-2008-5963: Improper Input Validation
Eval injection vulnerability in library/setup/rpc.php in Gravity Getting Things Done GTD 0.4.5 and earlier allows remote attackers to execute arbitrary PHP code via the objectname parameter...
CVE-2008-5962: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in library/setup/rpc.php in Gravity Getting Things Done GTD 0.4.5 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the objectname parameter...
Gravity GTD <= 0.4.5 (rpc.php objectname) LFI/RCE Vulnerability
Exploit for unknown platform in category web applications =============================================================== Gravity GTD = 0.4.5 rpc.php objectname LFI/RCE Vulnerability =============================================================== :::::::-. ... ::::::. :::. ;;, ';, ;; ;;;;;;;, ;;;...
Cross site scripting
Cross-site scripting XSS vulnerability in rpc.php in Unobtrusive Ajax Star Rating Bar before 1.2.0 allows remote attackers to inject arbitrary web script or HTML via the q parameter...
Sql injection
Multiple SQL injection vulnerabilities in Unobtrusive Ajax Star Rating Bar before 1.2.0 allow remote attackers to execute arbitrary SQL commands via the 1 q and 2 t parameters in a db.php and b rpc.php...
CVE-2007-3684
Multiple SQL injection vulnerabilities in Unobtrusive Ajax Star Rating Bar before 1.2.0 allow remote attackers to execute arbitrary SQL commands via the 1 q and 2 t parameters in a db.php and b rpc.php...
CVE-2007-3685
CVE-2007-3685 affects the Unobtrusive Ajax Star Rating Bar (rpc.php). The issue is a cross-site scripting (XSS) flaw that allows an attacker to inject arbitrary script/HTML via the q parameter in rpc.php, for versions before 1.2.0. The vulnerability is described across multiple sources as XSS in ...
CVE-2007-3684: Undefined Security Weakness
Multiple SQL injection vulnerabilities in Unobtrusive Ajax Star Rating Bar before 1.2.0 allow remote attackers to execute arbitrary SQL commands via the 1 q and 2 t parameters in a db.php and b rpc.php...