CVE-2014-2238

SQL injection vulnerability in the manage configuration page admconfigreport.php in MantisBT 1.2.13 through 1.2.16 allows remote authenticated administrators to execute arbitrary SQL commands via the filterconfigid parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in mods/standard/forums/admin/forumadd.php in ATutor 2.1.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the title parameter in an addforum action. NOTE: the original disclosure also reported issues that may not cross...

CVE-2014-2091

Cross-site scripting XSS vulnerability in mods/standard/forums/admin/forumadd.php in ATutor 2.1.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the title parameter in an addforum action. NOTE: the original disclosure also reported issues that may not cross...

CVE-2014-1459

SQL injection vulnerability in dg-admin/index.php in doorGets CMS 5.2 and earlier allows remote authenticated administrators to execute arbitrary SQL commands via the positiondownid parameter. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands...

Sql injection

SQL injection vulnerability in dg-admin/index.php in doorGets CMS 5.2 and earlier allows remote authenticated administrators to execute arbitrary SQL commands via the positiondownid parameter. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands...

CVE-2014-1459

SQL injection vulnerability in dg-admin/index.php in doorGets CMS 5.2 and earlier allows remote authenticated administrators to execute arbitrary SQL commands via the positiondownid parameter. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands...

Cross site scripting

Cross-site scripting XSS vulnerability in the web administration interface in FortiGuard FortiWeb 5.0.3 and earlier allows remote authenticated administrators to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-1458

Cross-site scripting XSS vulnerability in the web administration interface in FortiGuard FortiWeb 5.0.3 and earlier allows remote authenticated administrators to inject arbitrary web script or HTML via unspecified vectors...

Design/Logic Flaw

WordPress before 3.0.1, when a Multisite installation is used, permanently retains the "site administrators can add users" option once changed, which might allow remote authenticated administrators to bypass intended access restrictions in opportunistic circumstances via an add action after a...

CVE-2010-5297

The entry describes WordPress before 3.0.1 (Multisite) where the option “site administrators can add users”, once changed, is permanently retained and cannot be turned off. This may allow remote authenticated administrators to bypass intended access restrictions in opportunistic circumstances via...

CVE-2013-6725

Cross-site scripting XSS vulnerability in the Administrative Console in IBM WebSphere Application Server 7.x before 7.0.0.31, 8.0.x before 8.0.0.8, and 8.5.x before 8.5.5.2 allows remote authenticated administrators to inject arbitrary web script or HTML via a crafted URL...

CVE-2013-7242

SQL injection vulnerability in zp-core/zp-extensions/wordpressimport.php in Zenphoto before 1.4.5.4 allows remote authenticated administrators to execute arbitrary SQL commands via the tableprefix parameter...

CVE-2013-7242

SQL injection vulnerability in zp-core/zp-extensions/wordpressimport.php in Zenphoto before 1.4.5.4 allows remote authenticated administrators to execute arbitrary SQL commands via the tableprefix parameter...

CVE-2013-7194

Multiple cross-site scripting XSS vulnerabilities in www/administrator.php in eFront 3.6.14 build 18012 allow remote authenticated administrators to inject arbitrary web script or HTML via the 1 Last name, 2 Lesson name, or 3 Course name field...

CVE-2013-7194

CVE-2013-7194 describes multiple XSS vulnerabilities in the eFront 3.6.14 (build 18012) software, specifically in www/administrator.php. The underlying issue allows remote authenticated administrators to inject arbitrary web script or HTML via one of three fields: Last name, Lesson name, or Cours...

Command injection

McAfee Email Gateway 7.6 allows remote authenticated administrators to execute arbitrary commands by specifying them in the value attribute in a 1 Command or 2 Script XML element. NOTE: this issue can be combined with CVE-2013-7092 to allow remote attackers to execute commands...

CVE-2013-7103

McAfee Email Gateway 7.6 allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the value attribute in a 1 TestFile XML element or the 2 hostname. NOTE: this issue can be combined with CVE-2013-7092 to allow remote attackers to execute commands...

CVE-2013-6366

The Groovy script console in VMware Hyperic HQ 4.6.6 allows remote authenticated administrators to execute arbitrary code via a Runtime.getRuntime.exec call...

CVE-2013-6366

The Groovy script console in VMware Hyperic HQ 4.6.6 allows remote authenticated administrators to execute arbitrary code via a Runtime.getRuntime.exec call...

CVE-2013-6027

Stack-based buffer overflow in the RuntimeDiagnosticPing function in /bin/webs on D-Link DIR-100 routers might allow remote authenticated administrators to execute arbitrary commands via a long set/runtime/diagnostic/pingIp parameter to Tools/toolsmisc.xgi...