CVE-2012-0984

Multiple cross-site scripting XSS vulnerabilities in XOOPS before 2.5.5 allow remote attackers to inject arbitrary web script or HTML via the 1 touserid parameter to modules/pm/pmlite.php or the 2 currentfile, 3 imgcatid, or 4 target parameter to...

CVE-2012-0984

The CVE-2012-0984 entry affects XOOPS before 2.5.5, with multiple XSS vulnerabilities exploitable via user-controlled inputs in several PHP scripts: to_userid (modules/pm/pmlite.php), current_file, imgcat_id, and target (class/xoopseditor/tinymce/tinymce/jscripts/tiny_mce/plugins/xoopsimagemanage...

CVE-2012-0984: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in XOOPS before 2.5.5 allow remote attackers to inject arbitrary web script or HTML via the 1 touserid parameter to modules/pm/pmlite.php or the 2 currentfile, 3 imgcatid, or 4 target parameter to...

xoops module wiwimod 0.4 - Remote File Inclusion Vulnerability

No description provided by source. XOOPS Module WiwiMod v0.4 spawroot RFI Vulnerability D.Script: http://codigolivre.org.br/frs/download.php/1745/xoops2-modwiwimod0.4xavierjimenez.zip V.Code : include $spawroot.'config/spawcontrol.config.php'; include $spawroot.'class/toolbars.class.php'; include...

XOOPS Module XFsection <= 1.07 (articleid) BLIND SQL Injection Exploit

No description provided by source. html head titleXOOPS Module XFsection = 1.07 articleid BLIND SQL Injection Exploit/title script type=text/javascript //'=============================================================================================== //'Script Name: XOOPS Module XFsection = 1.07...

XOOPS <= 2.0.11 xmlrpc.php SQL Injection Exploit

No description provided by source. !/usr/bin/perl Xoops = 2.0.11 xmlrpc.php sql injection exploit by RST/GHC based on http://www.gulftech.org/?node=research&articleid=00086-06292005 coded by 1dt.w0lf RST/GHC http://rst.void.ru http://ghc.ru example: r57xoops.pl -u http://www.xoops2.ru/xmlrpc.php ...

tadbook2 Module for XOOPS 'open_book.php' SQL Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/33196/info The tadbook2 module for XOOPS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attack...

XOOPS Module Glossarie <= 1.7 (sid) Remote SQL Injection Exploit

No description provided by source. !/usr/bin/perl Script Name: XOOPS Module Glossarie = 1.7 sid Remote BLIND SQL Injection Exploit Coded by : ajann Author : ajann Contact : : Dork : inurl:/modules/glossaire/ S.Page : http://www.xoops.org/modules/repository/singlefile.php?cid=100&lid=1156 $$ : Fre...

Xoops 2.0.5 .1 MyLinks Myheader.php Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/9269/info Xoops is prone to a cross-site scripting vulnerability in the 'myheader.php' script included in the mylinks module. A remote attacker could exploit this issue by embedding hostile HTML and script code in a...

SmartMedia Module 0.85 Beta for XOOPS 'categoryid' Parameter Cross Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/37156/info The SmartMedia module for XOOPS is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script cod...

Xoops 1.3.x/2.0.x Multiple Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/9166/info Multiple vulnerabilities were reported in Xoops. These issues include SQL injection and input validation issues that will allow remote attackers to manipulate banners and local variables. Exploitation could...

XOOPS MyTutorials Module 2.1 - 'printpage.php' SQL Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/28230/info MyTutorials is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise t...

xoops module horoscope <= 2.0 - Remote File Inclusion Vulnerability

No description provided by source. BeyazKurt - [email protected] XOOPS Modules Horoscope http://www.xoops.org/modules/repository/visit.php?cid=32&lid=1162 modules/horoscope/footer.php?xoopsConfigrootpath= NetLife Since : '2003-4' Emekli Heykır BeyazKurt - Neti bıraktım! Dönüşüm mükemmel olcak...

XOOPS Module PopnupBlog <= 2.52 (postid) BLIND SQL Injection Exploit

No description provided by source. html head titleXOOPS Module PopnupBlog = 2.52 postid BLIND SQL Injection Exploit/title script type=text/javascript //'=============================================================================================== //'Script Name: XOOPS Module PopnupBlog = 2.52...

XOOPS 2.0.14 (article.php) SQL Injection Vulnerability

No description provided by source. / \ / | | | \ / | | | | | | | | | | || | | | | | | | | '| | | | | | | | | | |/ \ / |/ / / | | | | || | || | || || | / || | | | / | | || / / |/ || ,|\|,| +-+-+-+-+ |C|r|e|w| +-+-+-+-+ XOOPS 2.0.14 article.php SQL Injection Vulnerability Discovered By 0iZy5...

E-Xoops 1.0.5/1.0.8 myalbum/ratephoto.php lid Parameter SQL Injection

No description provided by source. source: http://www.securityfocus.com/bid/26796/info E-Xoops is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attacker to...

Xoops 1.3.5 Private Message System Font Attributes HTML Injection

No description provided by source. source: http://www.securityfocus.com/bid/6344/info Xoops includes a Private Message System for users, so that they may send messages to one another. HTML tags used for font attributes are not sufficiently filtered of malicious HTML code. This makes it possible f...

xoops module cjay content 3 - Remote File Inclusion Vulnerability

No description provided by source. / \ / \ | | | | | | | | | | | / | | | | | | | ' / | | ' \ / \ | | | | || | || | | | \ | | | | / | , |/ /|| ||| |||| / | |/ INFO: Program Title Cjay Content 3 WYSIWYG IE 5.5+ Remote File Inclusion Vulnerability Description Editor module for XOOPS CMS Vuln...

Xoops 2.0.5 NewList.PHP Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/20927/info Xoops is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code execute in the browser of an...

XOOPS 'badliege' Module - 'id' Parameter SQL Injection Vulnerability

XOOPS 'badliege' Module - 'id' Parameter SQL Injection Vulnerability 1.漏洞信息 XOOPS 'badliege'模块是一款基于PHP的WEB应用程序。 XOOPS 'badliege'模块不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击，可获得敏感信息或操作数据库。 问题是由于脚本对用户提交的'id'参数处理缺少充分过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。 2. 测试方法...