566 matches found
bcconsul.ru XSS vulnerability
Vulnerable URL: http://www.bcconsul.ru/bbs/user.php?EMAIL=--!%3E%22%3E%3C/script%20%3E%3Ciframe/onload=alert%28/XSSPOSED/%29%3E=vjkjrj Details: Description| Value ---|--- Patched:| No Latest check for patch:| 25.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank...
ECShop 2.5 /user.php SQL注入
No description provided by source...
CVE-2015-2271
tag/user.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 does not consider the moodle/tag:flag capability before proceeding with a flaginappropriate action, which allows remote authenticated users to bypass intended access restrictions via the "Flag as...
UCenter 1.6.0 /control/admin/user.php 验证码绕过漏洞
No description provided by source...
CVE-2015-2271: Undefined Security Weakness
tag/user.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 does not consider the moodle/tag:flag capability before proceeding with a flaginappropriate action, which allows remote authenticated users to bypass intended access restrictions via the "Flag as...
mcms最新版SQL注入一枚
简要描述： mcms最新版SQL注入一枚 详细说明： 掌易科技的程序员反应相当快啊，确认漏洞当天就修复以后出新版本了，前面在wooyun提的几个漏洞新版的mcms做了相应的处理，发布了新版v3.1.3.enterprise，再来研究研究。 注入一枚：/app/public/user.php?m=recharge&ajax=1 POST中有个参数params存在注入。 function mrecharge global $dbm; checklevel'C0503',AJAX; $fields = array;...
ECSHOP 2.7.2 /mobile/user.php SQL注入漏洞
No description provided by source...
phpBugTracker 1.6.0 - Multiple Vulnerabilities
Advisory: Multiple SQLi, stored/reflecting XSS- and CSRF-vulnerabilities in phpBugTracker v.1.6.0 Advisory ID: SROEADV-2015-16 Author: Steffen Rösemann Affected Software: phpBugTracker v.1.6.0 Vendor URL: https://github.com/a-v-k/phpBugTracker Vendor Status: patched CVE-ID: will asked to be...
MacCMS V8 /inc/module/user.php SQL注入漏洞
No description provided by source...
Sql injection
Multiple SQL injection vulnerabilities in Zoph aka Zoph Organizes Photos 0.9.1 and earlier allow remote authenticated users to execute arbitrary SQL commands via the 1 action parameter to group.php or 2 user.php or the 3 locationid parameter to photos.php in php/...
CVE-2014-9235
Multiple SQL injection vulnerabilities in Zoph aka Zoph Organizes Photos 0.9.1 and earlier allow remote authenticated users to execute arbitrary SQL commands via the 1 action parameter to group.php or 2 user.php or the 3 locationid parameter to photos.php in php/...
CVE-2014-9235: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL injection vulnerabilities in Zoph aka Zoph Organizes Photos 0.9.1 and earlier allow remote authenticated users to execute arbitrary SQL commands via the 1 action parameter to group.php or 2 user.php or the 3 locationid parameter to photos.php in php/...
CVE-2014-3302
user.php in Cisco WebEx Meetings Server 1.5.1.131 and earlier does not properly implement the token timer for authenticated encryption, which allows remote attackers to obtain sensitive information via a crafted URL, aka Bug ID CSCuj81708...
Design/Logic Flaw
user.php in Cisco WebEx Meetings Server 1.5.1.131 and earlier does not properly implement the token timer for authenticated encryption, which allows remote attackers to obtain sensitive information via a crafted URL, aka Bug ID CSCuj81708...
CVE-2014-3302
CVE-2014-3302 affects Cisco WebEx Meetings Server (1.5(.1.131) and earlier) in the user.php script. The root cause is an invalid token timer for authenticated encryption, allowing unauthenticated, remote attackers to view sensitive information via crafted URL requests. Exploitation described as u...
CVE-2014-3302: Undefined Security Weakness
user.php in Cisco WebEx Meetings Server 1.5.1.131 and earlier does not properly implement the token timer for authenticated encryption, which allows remote attackers to obtain sensitive information via a crafted URL, aka Bug ID CSCuj81708...
PHPNuke 1.0/2.5/3.0/4.x/5.x/6.x/7.x user.php uname Parameter XSS Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/3609/info PHPNuke is a website creation/maintenance tool. PHPNuke is prone to cross-site scripting attacks. It is possible to create a link to the PHPNuke user information page, 'user.php', which contains malicious script...
PostNuke 0.76 RC4b user.php htmltext Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/14635/info PostNuke is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied input. This can lead to theft of cookie-based...
VBulletin 1.0.1 lite/2.x/3.0 /admincp/user.php email Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/14874/info vBulletin is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage any of these issues t...
PHPX 3.x admin/user.php CSRF Arbitrary Command Execution
No description provided by source. source: http://www.securityfocus.com/bid/10284/info It has been reported that PHPX is affected by multiple administrator command execution vulnerabilities. These issues are due to a failure of the application to properly validate access to administrative command...