CVE-2012-5909: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/modules/user/users.php in MyBB aka MyBulletinBoard 1.6.6 allows remote attackers to execute arbitrary SQL commands via the conditionsusergroup parameter in a search action to admin/index.php...

Exploit Title: Mihalism Multi Host v 5.0

Exploit Title: Mihalism Multi Host v 5.0 Google Dork: intext:"powered by Mihalism Multi Host" Date: 2012/8/25 Discovered By : Explo!ter Software Link: http://www.mihalismscript.com/ Version: 5.0 Tested on: Linux Contact : Emperor-team.org Spt to : Stokke Details : ++++++++++++++++++++++++++ the...

Mihalism Multi Host 5.0 Cross Site Scripting

Exploit Title: Mihalism Multi Host v 5.0 Google Dork: intext:"powered by Mihalism Multi Host" Date: 2012/8/25 Discovered By : Explo!ter Software Link: http://www.mihalismscript.com/ Version: 5.0 Tested on: Linux Contact : Emperor-team.org Spt to : Stokke Details : ++++++++++++++++++++++++++ the...

Mihalism Multi Host - users.php Cross-Site Scripting

Mihalism Multi Host - users.php Cross-Site Scripting source: https://www.securityfocus.com/bid/55237/info Mihalism Multi Host is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script...

CVE-2012-4325: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in upload/users.php in Utopia News Pro UNP 1.4.0 and earlier allows remote attackers to hijack the authentication of administrators for requests that add administrator accounts...

CVE-2012-2236

PHP Gift Registry 1.5.5 is vulnerable to a SQL injection in users.php (userid parameter in the edit action). The issue allows remote authenticated users to execute arbitrary SQL commands. This is caused by unsafely concatenated input in the edit workflow, enabling database command execution. The ...

CVE-2012-2236: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in users.php in PHP Gift Registry 1.5.5 allows remote authenticated users to execute arbitrary SQL commands via the userid parameter in an edit action...

CVE-2012-2156: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Plume CMS 1.2.4 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the uemail parameter aka Authors Email field to manager/users.php, 2 the urealname parameter aka Authors Name field to manager/users.php, or 3 the...

PHP Gift Registry 1.5.5 - SQL Injection

Exploit Title: PHP Gift Registry 1.5.5 SQL Injection Date: 02/22/12 Author: G13 Software Link: https://sourceforge.net/projects/phpgiftreg/ Version: 1.5.5 Category: webapps php Vulnerability The userid parameter in the users.php file is vulnerable to SQL Injection. A user must be signed in to...

PHP Gift Registry 1.5.5 - SQL Injection

PHP Gift Registry 1.5.5 - SQL Injection Exploit Title: PHP Gift Registry 1.5.5 SQL Injection Date: 02/22/12 Author: G13 Software Link: https://sourceforge.net/projects/phpgiftreg/ Version: 1.5.5 Category: webapps php Vulnerability The userid parameter in the users.php file is vulnerable to SQL...

CVE-2010-5084: Cross-Site Request Forgery (CSRF)

The cross-site request forgery CSRF protection mechanism in e107 before 0.7.23 uses a predictable random token based on the creation date of the administrator account, which allows remote attackers to hijack the authentication of administrators for requests that add new users via...

CVE-2011-4920

Multiple cross-site scripting XSS vulnerabilities in e107 0.7.26, and other versions before 1.0.0, allow remote attackers to inject arbitrary web script or HTML via the URL to 1 e107images/thumb.php or 2 rate.php, 3 resendname parameter to e107admin/users.php, and 4 link BBCode in user signatures...

CVE-2011-4920: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in e107 0.7.26, and other versions before 1.0.0, allow remote attackers to inject arbitrary web script or HTML via the URL to 1 e107images/thumb.php or 2 rate.php, 3 resendname parameter to e107admin/users.php, and 4 link BBCode in user signatures...

CVE-2011-4669

The CVE-2011-4669 entry concerns a SQL injection in the WordPress Users plugin (wp-users.php) version 1.3 and potentially earlier. The vulnerability allows remote attackers to inject arbitrary SQL via the uid parameter to index.php, enabling unauthorized database operations. Root cause is imprope...

CVE-2011-4669: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in wp-users.php in WordPress Users plugin 1.3 and possibly earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the uid parameter to index.php...

CVE-2010-4874

Multiple cross-site scripting XSS vulnerabilities in users.php in NinkoBB 1.3 RC5 allow remote attackers to inject arbitrary web script or HTML via the 1 firstname, 2 lastname, 3 msn, or 4 aim parameter...

CVE-2010-4874

CVE-2010-4874 affects NinkoBB 1.3 RC5. Multiple XSS flaws in users.php allow injection of arbitrary script/HTML via parameters first_name, last_name, msn, and aim due to input sanitation error. This enables a remote attacker to execute scripts in a victim’s browser in the context of the vulnerabl...

CVE-2010-4874: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in users.php in NinkoBB 1.3 RC5 allow remote attackers to inject arbitrary web script or HTML via the 1 firstname, 2 lastname, 3 msn, or 4 aim parameter...

glFusion 1.1.x/1.2.1 - 'users.php' SQL Injection

source: https://www.securityfocus.com/bid/46575/info glFusion is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data...

Greeklog CMS Blind SQL Injection

Title: Greeklog CMS Blind Sql Injection Vulnerability Dork:"Powered By Greeklog" Vulnerable Page : users.php?mode=Blind Sqli Author: H3X Credit: Sepehr Security Team Site :WWW.Sepehr-Team.Org Date:2011/2/22...