537 matches found
CVE-2012-2156
Multiple cross-site scripting XSS vulnerabilities in Plume CMS 1.2.4 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the uemail parameter aka Authors Email field to manager/users.php, 2 the urealname parameter aka Authors Name field to manager/users.php, or 3 the...
Cross site scripting
Cross-site scripting XSS vulnerability in zp-core/admin.php in Zenphoto 1.3 allows remote attackers to inject arbitrary web script or HTML via the user parameter. NOTE: the from parameter is already covered by CVE-2009-4562...
CVE-2009-4842
Multiple cross-site scripting XSS vulnerabilities in ToutVirtual VirtualIQ Pro 3.5 build 8691 allow remote attackers to inject arbitrary web script or HTML via the 1 addNewDept, 2 deptId, or 3 deptDesc parameter to tvserver/server/user/addDepartment.jsp; or the 4 firstName, 5 lastName, or 6 email...
CVE-2010-1709
Multiple cross-site scripting XSS vulnerabilities in upload.cgi in G5-Scripts Auto-Img-Gallery 1.1 allow remote attackers to inject arbitrary web script or HTML via the 1 user and 2 pass parameters...
CVE-2009-4721
CVE-2009-4721 affects Andrews-Web (A-W) BannerAd 1.0, with multiple SQL injection vulnerabilities in Admin/index.asp that allow remote attackers to execute arbitrary SQL commands via the (1) User and (2) Password parameters. The root cause is unsafely constructed SQL queries in that page, enablin...
CVE-2009-3171
Multiple cross-site scripting XSS vulnerabilities in Anantasoft Gazelle CMS 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 user parameter to user.php or 2 lookup parameter to search.php...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in Anantasoft Gazelle CMS 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 user parameter to user.php or 2 lookup parameter to search.php...
CVE-2009-3171
Multiple cross-site scripting XSS vulnerabilities in Anantasoft Gazelle CMS 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 user parameter to user.php or 2 lookup parameter to search.php...
Sql injection
Multiple SQL injection vulnerabilities in OneCMS 2.4, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the 1 username parameter $usernameb variable to alogin.php or 2 user parameter to staff.php...
CVE-2009-1816
SQL injection vulnerability in admin.php in My Game Script 2.0 allows remote attackers to execute arbitrary SQL commands via the user parameter aka the username field. NOTE: some of these details are obtained from third party information...
LimeSurvey sUser Parameter SQL Injection
The remote host is running LimeSurvey, an open source tool for online surveys. The version of LimeSurvey installed on the remote host fails to sanitize user-supplied input passed to the 'sUser' argument in the 'checkUser' method of the 'LsrcHelper' class in 'admin/remotecontrol/lsrc.helper.php'...
CVE-2008-6631
Multiple cross-site scripting XSS vulnerabilities in index.php in BlogPHP 2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 user parameter in a sendmessage action and the 2 username parameter when registering a new user, different vectors than CVE-2008-0679...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in index.php in BlogPHP 2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 user parameter in a sendmessage action and the 2 username parameter when registering a new user, different vectors than CVE-2008-0679...
Sql injection
Multiple SQL injection vulnerabilities in nForum 1.5 allow remote attackers to execute arbitrary SQL commands via the 1 id parameter to showtheme.php and the 2 user parameter to userinfo.php...
CVE-2009-0852
showme.php in CelerBB 0.0.2 allows remote attackers to obtain "reserved information" via the user parameter...
Code injection
showme.php in CelerBB 0.0.2 allows remote attackers to obtain "reserved information" via the user parameter...
CVE-2009-0852
showme.php in CelerBB 0.0.2 allows remote attackers to obtain "reserved information" via the user parameter...
CVE-2009-0852
CVE-2009-0852 concerns CelerBB 0.0.2. Multiple connected sources confirm that the vulnerability exists in the showme.php module via the user parameter, enabling remote attackers to retrieve sensitive or “reserved” information. The CVE description and corroborating entries (including exploit refer...