CVE-2014-10005

Maian Uploader 4.0 allows remote attackers to obtain sensitive information via a request without the height parameter to loadflv.js.php, which reveals the installation path in an error message...

CVE-2014-10004

SQL injection vulnerability in admin/datafiles/move.php in Maian Uploader 4.0 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2014-10003

Multiple cross-site scripting XSS vulnerabilities in Maian Uploader 4.0 allow remote attackers to inject arbitrary web script or HTML via the width parameter to 1 uploader/admin/js/loadflv.js.php or 2 uploader/js/loadflv.js.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Maian Uploader 4.0 allow remote attackers to inject arbitrary web script or HTML via the width parameter to 1 uploader/admin/js/loadflv.js.php or 2 uploader/js/loadflv.js.php...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Maian Uploader 4.0 allow remote attackers to hijack the authentication of unspecified users for requests that conduct cross-site scripting XSS attacks via the width parameter to 1 uploader/admin/js/loadflv.js.php or 2...

Sql injection

SQL injection vulnerability in admin/datafiles/move.php in Maian Uploader 4.0 allows remote attackers to execute arbitrary SQL commands via the id parameter...

Design/Logic Flaw

Maian Uploader 4.0 allows remote attackers to obtain sensitive information via a request without the height parameter to loadflv.js.php, which reveals the installation path in an error message...

CVE-2014-10006

Multiple cross-site request forgery CSRF vulnerabilities in Maian Uploader 4.0 allow remote attackers to hijack the authentication of unspecified users for requests that conduct cross-site scripting XSS attacks via the width parameter to 1 uploader/admin/js/loadflv.js.php or 2...

CVE-2014-10003

Multiple cross-site scripting XSS vulnerabilities in Maian Uploader 4.0 allow remote attackers to inject arbitrary web script or HTML via the width parameter to 1 uploader/admin/js/loadflv.js.php or 2 uploader/js/loadflv.js.php...

CVE-2014-10004

SQL injection vulnerability in admin/datafiles/move.php in Maian Uploader 4.0 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2014-10003

CVE-2014-10003 affects Maian Uploader 4.0. The connected documents confirm multiple cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary web script or HTML through the width parameter in either uploader/admin/js/load_flv.js.php or uploader/js/load_flv.js.php....

CVE-2014-10004

Maian Uploader 4.0 is affected by a SQL injection in admin/data_files/move.php via the id parameter, enabling remote attackers to execute arbitrary SQL commands. No exploit specifics or mitigation details are provided in the connected documents; implications are partial confidentiality/integrity ...

CVE-2014-10005

CVE-2014-10005 affects Maian Uploader 4.0. The issue arises when requesting load_flv.js.php without the required height parameter, which may cause an error message that reveals the installation path. This is a potential information disclosure in the affected component (load_flv.js.php). The docum...

CVE-2014-10005

Maian Uploader 4.0 allows remote attackers to obtain sensitive information via a request without the height parameter to loadflv.js.php, which reveals the installation path in an error message...

CVE-2014-10006

Maian Uploader 4.0 is affected by multiple CSRF vulnerabilities that allow an attacker to hijack user authentication for requests that trigger XSS via the width parameter in uploader/admin/js/load_flv.js.php and uploader/js/load_flv.js.php. The CVE description indicates these are CSRF issues lead...

PT-2015-3648

Name of the Vulnerable Software and Affected Versions Maian Uploader version 4.0 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the id parameter in the "admin/data files/move.php" endpoint. Recommendations For Maian Uploader version 4.0, avoi...

PT-2015-3637

Name of the Vulnerable Software and Affected Versions Maian Uploader version 4.0 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The injection can occur via the width parameter t...

PT-2015-3650

Name of the Vulnerable Software and Affected Versions Maian Uploader version 4.0 Description The issue concerns multiple cross-site request forgery CSRF vulnerabilities that allow remote attackers to hijack the authentication of unspecified users. This can lead to requests that conduct cross-site...

CVE-2014-10004: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/datafiles/move.php in Maian Uploader 4.0 allows remote attackers to execute arbitrary SQL commands via the id parameter...

PT-2015-3649

Name of the Vulnerable Software and Affected Versions Maian Uploader version 4.0 Description The issue allows remote attackers to obtain sensitive information. This is achieved by sending a request without the height parameter to the "load flv.js.php" endpoint, which in turn reveals the...