Cross site scripting

An issue was discovered in Skybox Platform before 7.5.401. Reflected cross-site scripting vulnerabilities exist in /skyboxview/webservice/services/VersionRepositoryWebService via a soapenv:Body element, or in the status parameter to login.html...

CVE-2015-9247: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Skybox Platform before 7.5.401. Reflected cross-site scripting vulnerabilities exist in /skyboxview/webservice/services/VersionRepositoryWebService via a soapenv:Body element, or in the status parameter to login.html...

Evolution Script CMS Cross-Site Scripting Vulnerability

Evolution Script is managed by a team of professionals specializing in pay-per-click software development. A cross-site scripting vulnerability exists in the "status" parameter of the "Ticket Support" module of Evolution Script CMS version 5.3, which can be exploited by remote attackers to inject...

Fast Breakfast App Has Arbitrary User Payment Password Change Vulnerability

Fast Breakfast APP is a mobile service software. There is an arbitrary user payment password modification vulnerability in Fast Breakfast APP. Due to the use of loginStatus and userTel parameters to query the userID of any user, it is possible to modify the payment password of any user...

Sql injection

Multiple SQL injection vulnerabilities in the admin panel in osCMax before 2.5.1 allow 1 remote attackers to execute arbitrary SQL commands via the username parameter in a process action to admin/login.php or 2 remote administrators to execute arbitrary SQL commands via the status parameter to...

CVE-2012-6691

Multiple cross-site request forgery CSRF vulnerabilities in the admin panel in osCMax before 2.5.1 allow remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the 1 status parameter to admin/statsmonthlysales.php or 2 country parameter...

CVE-2012-1665

Multiple SQL injection vulnerabilities in the admin panel in osCMax before 2.5.1 allow 1 remote attackers to execute arbitrary SQL commands via the username parameter in a process action to admin/login.php or 2 remote administrators to execute arbitrary SQL commands via the status parameter to...

CVE-2015-1176

Cross-site scripting XSS vulnerability in upload/scp/tickets.php in osTicket before 1.9.5 allows remote attackers to inject arbitrary web script or HTML via the status parameter in a search action...

CVE-2015-1176: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in upload/scp/tickets.php in osTicket before 1.9.5 allows remote attackers to inject arbitrary web script or HTML via the status parameter in a search action...

CVE-2014-4965

Multiple cross-site scripting XSS vulnerabilities in Shopizer 1.1.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 customername parameter to central/orders/searchcriteria.action; 2 productname, 3 availability, or 4 status parameter to...

CVE-2014-4965

Multiple cross-site scripting XSS vulnerabilities in Shopizer 1.1.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 customername parameter to central/orders/searchcriteria.action; 2 productname, 3 availability, or 4 status parameter to...

CVE-2012-6560

SQL injection vulnerability in deviceadd.php in FreeNAC 3.02 allows remote attackers to execute arbitrary SQL commands via the status parameter...

Sql injection

SQL injection vulnerability in deviceadd.php in FreeNAC 3.02 allows remote attackers to execute arbitrary SQL commands via the status parameter...

CVE-2012-6560: Improper Input Validation

SQL injection vulnerability in deviceadd.php in FreeNAC 3.02 allows remote attackers to execute arbitrary SQL commands via the status parameter...

CVE-2012-3791: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Simple Web Content Management System 1.1 allow remote attackers to execute arbitrary SQL commands via the id parameter to 1 itemdelete.php, 2 itemstatus.php, 3 itemdetail.php, 4 itemmodify.php, or 5 itemposition.php in admin/; or 6 status parameter to...

CVE-2011-5022: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in search.php in Pligg CMS 1.1.2 allows remote attackers to execute arbitrary SQL commands via the status parameter...

PT-2011-5169 · Pligg · Pligg Cms

Name of the Vulnerable Software and Affected Versions: Pligg CMS version 1.1.2 Description: The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the status parameter in the "search.php" file. Recommendations: For Pligg CMS version 1.1.2, consider restricting...

Traq 2.2 - Multiple SQL Injections Cross-Site Scripting

Traq 2.2 - Multiple SQL Injections Cross-Site Scripting source: https://www.securityfocus.com/bid/49835/info Traq is prone to multiple SQL-injection and cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input. Exploiting these vulnerabilities could allow...

CVE-2011-0504: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in VaM Shop 1.6, 1.6.1, and probably earlier versions llow remote attackers to inject arbitrary web script or HTML via the 1 status parameter to admin/orders.php, 2 search parameter to admin/customers.php, or 3 STORENAME parameter to...