Evaria ECMS 'Poll.php' Local File Disclosure Vulnerability

Evaria ECMS is prone to a local file-disclosure vulnerability because it fails to adequately validate user-supplied input. Exploiting this vulnerability would allow an attacker to obtain potentially sensitive information from local files on computers running the vulnerable application. This may a...

Docebo 3.6 - description Cross-Site Scripting

Docebo 3.6 - description Cross-Site Scripting source: https://www.securityfocus.com/bid/43721/info Docebo is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the...

Novell iManager 'getMultiPartParameters()' Arbitrary File Upload Vulnerability

Novell iManager is prone to an arbitrary-file-upload vulnerability because it fails to properly sanitize user- supplied input. An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable...

Surgemail SurgeWeb 4.3e - Cross-Site Scripting

source: https://www.securityfocus.com/bid/43679/info SurgeMail is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context...

Surgemail SurgeWeb 4.3e - Cross-Site Scripting

Surgemail SurgeWeb 4.3e - Cross-Site Scripting source: https://www.securityfocus.com/bid/43679/info SurgeMail is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the...

jCart 1.1 - Multiple Cross-Site Scripting / Cross-Site Request Forgery/Open Redirect Vulnerabilities

additem$itemid, $itemqty, $itemprice, $itemname; ------------------------- User-supplied input for variable $itemname isn't properly escaped. Proof-of-Concept: -- alertdocument.cookie" type="hidden" document.getElementById'payload'.click !-- Vulnerable code snippet jcart-gateway.php:...

Tiki Wiki CMS Groupware 5.2 - Multiple Vulnerabilities

source: https://www.securityfocus.com/bid/43507/info Tiki Wiki CMS Groupware is prone to a local file-include vulnerability and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit the local file-include vulnerability using...

MODX <= 2.0.2 Multiple Vulnerabilities - Active Check

MODX is prone to a local file include LFI vulnerability and a cross-site scripting XSS vulnerability because it fails to properly sanitize user-supplied input. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

Mura CMS link Parameter XSS

The version of Mura CMS hosted on the remote web server fails to sanitize user-supplied input to the 'link' parameter of the 'default/includes/displayobjects/sendtofriend/index.cfm' script before using it to generate dynamic HTML output. An attacker may be able to leverage this issue to inject...

Getsimple CMS 2.01 - changedata.php Cross-Site Scripting

Getsimple CMS 2.01 - changedata.php Cross-Site Scripting source: https://www.securityfocus.com/bid/43593/info GetSimple CMS is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary scri...

phpMyFAQ 'index.php' Cross Site Scripting Vulnerability

phpMyFAQ is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to stea...

phpMyFAQ 'index.php' XSS Vulnerability

phpMyFAQ is prone to a cross-site scripting XSS vulnerability because it fails to properly sanitize user-supplied input. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

PHPMyFAQ 2.6.x - 'index.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/43560/info phpMyFAQ is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of t...

PHPMyFAQ 2.6.x - index.php Cross-Site Scripting

PHPMyFAQ 2.6.x - index.php Cross-Site Scripting source: https://www.securityfocus.com/bid/43560/info phpMyFAQ is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the...

QuickShare <= 1.0 Directory Traversal Vulnerability - Active Check

QuickShare is prone to a directory traversal vulnerability because it fails to sufficiently sanitize user-supplied input. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Nagios XI 'users.php' Multiple Cross-Site Scripting Vulnerabilities

Nagios XI is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the...

YelloSoft Pinky 1.0 - Directory Traversal

YelloSoft Pinky 1.0 - Directory Traversal source: https://www.securityfocus.com/bid/43358/info Pinky is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input. Exploiting this issue will allow an attacker to read files outside the webroot...

AContent 1.0 - Cross-Site Scripting HTML Injection

AContent 1.0 - Cross-Site Scripting HTML Injection source: https://www.securityfocus.com/bid/43238/info AContent is prone to multiple cross-site scripting vulnerabilities and an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically...

NWS-Classifieds - 'cmd' Local File Inclusion

source: https://www.securityfocus.com/bid/43259/info NWS-Classifieds is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability to obtain potentially sensitive information and to execute arbitrary local...

AChecker 1.0 - URI Cross-Site Scripting

AChecker 1.0 - URI Cross-Site Scripting source: https://www.securityfocus.com/bid/43240/info AChecker is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in th...