CVE-2012-1112: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Open-Realty CMS 2.5.8 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the selectuserstemplate parameter to index.php...

CVE-2012-4279

Multiple SQL injection vulnerabilities in Free Realty 3.1-0.6 allow remote attackers to execute arbitrary SQL commands via the 1 view parameter to agentdisplay.php or 2 edit parameter to admin/admin.php...

CVE-2012-4278

Multiple cross-site scripting XSS vulnerabilities in Free Realty 3.1-0.6 allow remote attackers to inject arbitrary web script or HTML via the 1 notes parameter to a admin/agenteditor.php; 2 title, 3 previewdesc, 4 fulldesc, or 5 notes parameter b to agentadmin.php or c in an addlisting action to...

CVE-2012-4280

Multiple cross-site request forgery CSRF vulnerabilities in admin/agenteditor.php in Free Realty 3.1-0.6 allow remote attackers to hijack the authentication of administrators for requests that 1 add an agent via an addagent action or 2 modify an agent...

Sql injection

Multiple SQL injection vulnerabilities in Free Realty 3.1-0.6 allow remote attackers to execute arbitrary SQL commands via the 1 view parameter to agentdisplay.php or 2 edit parameter to admin/admin.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Free Realty 3.1-0.6 allow remote attackers to inject arbitrary web script or HTML via the 1 notes parameter to a admin/agenteditor.php; 2 title, 3 previewdesc, 4 fulldesc, or 5 notes parameter b to agentadmin.php or c in an addlisting action to...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in admin/agenteditor.php in Free Realty 3.1-0.6 allow remote attackers to hijack the authentication of administrators for requests that 1 add an agent via an addagent action or 2 modify an agent...

CVE-2012-4278

Multiple cross-site scripting XSS vulnerabilities in Free Realty 3.1-0.6 allow remote attackers to inject arbitrary web script or HTML via the 1 notes parameter to a admin/agenteditor.php; 2 title, 3 previewdesc, 4 fulldesc, or 5 notes parameter b to agentadmin.php or c in an addlisting action to...

CVE-2012-4279

Multiple SQL injection vulnerabilities in Free Realty 3.1-0.6 allow remote attackers to execute arbitrary SQL commands via the 1 view parameter to agentdisplay.php or 2 edit parameter to admin/admin.php...

CVE-2012-4280

Multiple cross-site request forgery CSRF vulnerabilities in admin/agenteditor.php in Free Realty 3.1-0.6 allow remote attackers to hijack the authentication of administrators for requests that 1 add an agent via an addagent action or 2 modify an agent...

CVE-2012-4278

CVE-2012-4278 describes multiple cross-site scripting (XSS) vulnerabilities in Free Realty 3.1-0.6. The issues allow remote attackers to inject arbitrary scripts via: (1) the notes parameter to admin/agenteditor.php; (2) the title, (3) previewdesc, (4) fulldesc, or (5) notes parameter to agentadm...

CVE-2012-4279

Free Realty 3.1-0.6 contains SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands via the view parameter in agentdisplay.php or the edit parameter in admin/admin.php. The issue is described across multiple sources as consistent with unparameterized input lea...

CVE-2012-4280

CVE-2012-4280 affects Free Realty 3.1-0.6, with multiple CSRF weaknesses in admin/agenteditor.php. The flaws allow remote attackers to hijack administrator sessions by issuing requests to add an agent (addagent action) or modify an existing agent, compromising authentication integrity. Exploitati...

PT-2012-5306

Name of the Vulnerable Software and Affected Versions Free Realty versions 3.1-0.6 Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting XSS attacks. This can be achieved via several parameters, including notes to...

CVE-2012-4280: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in admin/agenteditor.php in Free Realty 3.1-0.6 allow remote attackers to hijack the authentication of administrators for requests that 1 add an agent via an addagent action or 2 modify an agent...

CVE-2012-4279: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Free Realty 3.1-0.6 allow remote attackers to execute arbitrary SQL commands via the 1 view parameter to agentdisplay.php or 2 edit parameter to admin/admin.php...

CVE-2012-4278: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Free Realty 3.1-0.6 allow remote attackers to inject arbitrary web script or HTML via the 1 notes parameter to a admin/agenteditor.php; 2 title, 3 previewdesc, 4 fulldesc, or 5 notes parameter b to agentadmin.php or c in an addlisting action to...

PT-2012-5307

Name of the Vulnerable Software and Affected Versions Free Realty versions 3.1-0.6 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the view parameter to "agentdisplay.php" or the edit parameter to "admin/admin.php". Recommendations For Fre...

PT-2012-5308

Name of the Vulnerable Software and Affected Versions Free Realty versions 3.1-0.6 Description The issue concerns multiple cross-site request forgery CSRF vulnerabilities. These vulnerabilities allow remote attackers to hijack the authentication of administrators for specific requests, including...

Free Realty 3.1-0.6 - Multiple Vulnerabilities

Free Realty 3.1-0.6 - Multiple Vulnerabilities Title: ====== Free Reality v3.1-0.6 - Multiple Web Vulnerabilities Date: ===== 2012-05-07 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=513 VL-ID: ===== 513 Common Vulnerability Scoring System:...