Design/Logic Flaw

XOOPS Core 2.5.8.1 has XSS due to unescaped HTML output of an Install DB failure error message in pagedbsettings.php...

CVE-2017-7944

XOOPS Core 2.5.8.1 has XSS due to unescaped HTML output of an Install DB failure error message in pagedbsettings.php...

CVE-2017-7944

CVE-2017-7944 affects XOOPS Core 2.5.8.1. The vulnerability is a cross-site scripting (XSS) flaw caused by unescaped HTML output in the Install DB failure error message shown by page_dbsettings.php. Public sources in connected documents consistently describe the issue as an XSS in XOOPS Core 2.5....

CVE-2017-7944

XOOPS Core 2.5.8.1 has XSS due to unescaped HTML output of an Install DB failure error message in pagedbsettings.php...

CVE-2017-7944: Improper Neutralization of Input During Web Page Generation

XOOPS Core 2.5.8.1 has XSS due to unescaped HTML output of an Install DB failure error message in pagedbsettings.php...

XOOPS 'findusers.php' SQL Injection Vulnerability

XOOPS is prone to an SQL injection vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xoops:xoops"; ifdescription...

Xoops SQL Injection Vulnerability

XOOPS eXtensible Object Oriented Portal System is XOOPS team development and maintenance of a set of open source based on PHP and MySQL content management system . A SQL injection vulnerability exists in Xoops' findusers.php page. Since the url parameter is not filtered for malicious characters, ...

Sql injection

SQL injection vulnerability in XOOPS 2.5.7.2 and other versions before 2.5.8.1 allows remote authenticated administrators to execute arbitrary SQL commands via the url parameter to findusers.php. An example attack uses "into outfile" to create a backdoor program...

CVE-2017-7290

SQL injection vulnerability in XOOPS 2.5.7.2 and other versions before 2.5.8.1 allows remote authenticated administrators to execute arbitrary SQL commands via the url parameter to findusers.php. An example attack uses "into outfile" to create a backdoor program...

CVE-2017-7290

SQL injection vulnerability in XOOPS 2.5.7.2 and other versions before 2.5.8.1 allows remote authenticated administrators to execute arbitrary SQL commands via the url parameter to findusers.php. An example attack uses "into outfile" to create a backdoor program...

CVE-2017-7290

SQL injection vulnerability in XOOPS 2.5.7.2 and other versions before 2.5.8.1 allows remote authenticated administrators to execute arbitrary SQL commands via the url parameter to findusers.php. An example attack uses "into outfile" to create a backdoor program...

CVE-2017-7290

XOOPS (eXtensible Object Oriented Portal System) contains a SQL injection vulnerability in findusers.php affecting XOOPS 2.5.7.2 and other versions prior to 2.5.8.1. The flaw allows authenticated remote administrators to execute arbitrary SQL commands via the url parameter to findusers.php, with ...

CVE-2017-7290: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in XOOPS 2.5.7.2 and other versions before 2.5.8.1 allows remote authenticated administrators to execute arbitrary SQL commands via the url parameter to findusers.php. An example attack uses "into outfile" to create a backdoor program...

XOOPS Cross-Site Request Forgery Vulnerability

XOOPS eXtensible Object Oriented Portal System is XOOPS team development and maintenance of a set of open source based on PHP and MySQL content management system . Cross-site request forgery vulnerabilities exist in XOOPS 2.5.7.2. A remote attacker can exploit these vulnerabilities to perform...

Xoops 2.5.7.2 - Directory Traversal Bypass

No description provided by source...

Xoops 2.5.7.2 - Arbitrary User Deletions CSRF

No description provided by source...

Xoops 2.5.7.2 - Cross-Site Request Forgery (Arbitrary User Deletions)

Exploit for php platform in category web applications var c=-1 var amttodelete=100 var id=document.getElementById"ids" var frm=document.getElementById"CSRF" function doit c++ arguments1.valu...

Xoops 2.5.7.2 - Cross-Site Request Forgery (Arbitrary User Deletions)

Xoops 2.5.7.2 - Cross-Site Request Forgery Arbitrary User Deletions var c=-1 var amttodelete=100 var id=document.getElementById"ids" var frm=document.getEleme...

Xoops 2.5.7.2 - Cross-Site Request Forgery (Arbitrary User Deletions)

var c=-1 var amttodelete=100 var id=document.getElementById"ids" var frm=document.getElementById"CSRF" function doit c++ arguments1.value=c arguments0...

XOOPS 2.5.7.2 - Directory Traversal Bypass

XOOPS 2.5.7.2 - Directory Traversal Bypass + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/XOOPS-DIRECTORY-TRAVERSAL.txt Vendor: ============= xoops.org Product: ================ Xoops 2.5.7.2 Vulnerability Type:...