Sql injection

SQL injection vulnerability in register/ in Subrion CMS before 2.2.3 allows remote attackers to execute arbitrary SQL commands via the planid parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in the poll module in Subrion CMS 2.0.4 allows remote attackers to inject arbitrary web script or HTML via the title field. NOTE: some of these details are obtained from third party information. NOTE: this might overlap CVE-2012-5452...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Subrion CMS 2.2.1 allow remote attackers to inject arbitrary web script or HTML via the 1 multititle parameter to blocks/add/; 2 cost, 3 days, or 4 titleen parameter to plans/add/; 5 name or 6 titleen parameter to fields/group/add/ in...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Subrion CMS before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the id parameter to 1 admin/accounts/, 2 admin/manage/, or 3 admin/manage/blocks/edit/; or 4 group parameter to admin/configuration/. NOTE: The...

CVE-2011-5211

Cross-site scripting XSS vulnerability in the poll module in Subrion CMS 2.0.4 allows remote attackers to inject arbitrary web script or HTML via the title field. NOTE: some of these details are obtained from third party information. NOTE: this might overlap CVE-2012-5452...

CVE-2012-4772

SQL injection vulnerability in register/ in Subrion CMS before 2.2.3 allows remote attackers to execute arbitrary SQL commands via the planid parameter...

CVE-2012-4771

Multiple cross-site scripting XSS vulnerabilities in Subrion CMS before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the id parameter to 1 admin/accounts/, 2 admin/manage/, or 3 admin/manage/blocks/edit/; or 4 group parameter to admin/configuration/. NOTE: The...

CVE-2012-5452

Multiple cross-site scripting XSS vulnerabilities in Subrion CMS 2.2.1 allow remote attackers to inject arbitrary web script or HTML via the 1 multititle parameter to blocks/add/; 2 cost, 3 days, or 4 titleen parameter to plans/add/; 5 name or 6 titleen parameter to fields/group/add/ in...

CVE-2011-5211

The CVE-2011-5211 entry is an XSS vulnerability in the Subrion CMS poll module (version 2.0.4) where an attacker could inject arbitrary script/HTML via the title field. The connected documents corroborate related XSS issues in Subrion CMS (e.g., CVE-2012-5452) affecting later versions (2.2.x) and...

CVE-2012-4773

Multiple cross-site request forgery CSRF vulnerabilities in Subrion CMS before 2.2.3 allow remote attackers to hijack the authentication of administrators for requests that add, delete, or modify sensitive information, as demonstrated by adding an administrator account via an add action to...

CVE-2011-5212

SQL injection vulnerability in admin/index.php in Subrion CMS 2.0.4 allows remote attackers to execute arbitrary SQL commands via the 1 user name or 2 password field...

CVE-2012-5452

CVE-2012-5452 affects Subrion CMS 2.2.1, with multiple XSS vectors exploitable via parameters across blocks/add, plans/add, fields/group/add (admin/manage), and advsearch. The root cause is improper input handling that allows injection of arbitrary scripts/HTML into user-visible fields (e.g., mul...

CVE-2012-4773

Subrion CMS before 2.2.3 contains multiple vulnerabilities: CVE-2012-4771 (XSS), CVE-2012-4772 (SQLi), and CVE-2012-4773 (CSRF) that can enable an attacker to hijack administrator sessions, perform unauthorized actions (including creating an admin account via /admin/accounts/add/), and modify sen...

CVE-2012-4772

Subrion CMS prior to 2.2.3 contains a SQL Injection in the /register/ path (parameter plan_id) that allows remote attackers to alter SQL queries and potentially compromise the system. The vulnerability (CVE-2012-4772) is described in multiple sources as a classic injection through the plan_id fie...

CVE-2012-4771

Subrion CMS

CVE-2011-5212

The vulnerability CVE-2011-5212 affects Subrion CMS 2.0.4, specifically an SQL injection in admin/index.php that allows remote attackers to execute arbitrary SQL commands via the (1) username or (2) password fields. The issue arises from improper handling of user-supplied input in the login form,...

subrion CMS 2.2.1 - Multiple Vulnerabilities

subrion CMS 2.2.1 - Multiple Vulnerabilities Advisory ID: HTB23113 Product: Subrion CMS Vendor: The Subrion development team Vulnerable Versions: 2.2.1 and probably prior Tested Version: 2.2.1 Vendor Notification: September 5, 2012 Public Disclosure: October 17, 2012 Vulnerability Type: SQL...

subrion CMS 2.2.1 - Multiple Vulnerabilities

Advisory ID: HTB23113 Product: Subrion CMS Vendor: The Subrion development team Vulnerable Versions: 2.2.1 and probably prior Tested Version: 2.2.1 Vendor Notification: September 5, 2012 Public Disclosure: October 17, 2012 Vulnerability Type: SQL Injection CWE-89, Cross-Site Scripting CWE-79,...

Multiple vulnerabilities in Subrion CMS

Advisory ID: HTB23113 Product: Subrion CMS Vendor: The Subrion development team Vulnerable Versions: 2.2.1 and probably prior Tested Version: 2.2.1 Vendor Notification: September 5, 2012 Public Disclosure: October 17, 2012 Vulnerability Type: SQL Injection CWE-89, Cross-Site Scripting CWE-79,...

Subrion CMS 2.2.1 XSS / CSRF / SQL Injection

Advisory ID: HTB23113 Product: Subrion CMS Vendor: The Subrion development team Vulnerable Versions: 2.2.1 and probably prior Tested Version: 2.2.1 Vendor Notification: September 5, 2012 Public Disclosure: October 17, 2012 Vulnerability Type: SQL Injection CWE-89, Cross-Site Scripting CWE-79,...