277 matches found
CVE-2012-5899: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in admin/action/objects.php in SAMEDIA LandShop 0.9.2 allows remote attackers to inject arbitrary web script or HTML via the OTRHEADS parameter in an edit action. NOTE: some of these details are obtained from third party information...
PT-2012-6180
Name of the Vulnerable Software and Affected Versions SAMEDIA LandShop version 0.9.2 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the OTR HEADS parameter in an edit action on the "admin/action/objects.php" endpoint. Recommendation...
PT-2012-6181
Name of the Vulnerable Software and Affected Versions SAMEDIA LandShop version 0.9.2 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the OB ID parameter in a single action to "admin/action/objects.php", the AREA ID parameter in a single...
CVE-2012-3362
Cross-site request forgery CSRF vulnerability in eXtplorer 2.1 RC3 and earlier allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via an adduser admin action...
CVE-2012-3362
CVE-2012-3362 describes a Cross-site request forgery (CSRF) in eXtplorer up to version 2.1 RC3 and earlier. An attacker could hijack administrator authentication to perform actions—specifically, to add an administrator account via an adduser admin action. Affected software is eXtplorer; root caus...
QuickCart Multiple vlunerabilities
DISCOVERED: Pawel 'kl3ryk' Laskarzewski GREETZ: hawk, pin3ska, black ant, qwert666, ua and gacmaan DIRECTORY TRAVERSAL http://victim.com/?p=ONE OF THE EXISITING FILES-EXISITING ACTION IN THIS FILE- Most of actions load templates form bad directory and then throw an exception. example:...
QuickCart 3.x xss xsrf Local File Inclusion Directory Traversal
No description provided by source. DISCOVERED: PaweÅ‚ 'kl3ryk' Åaskarzewski GREETZ: hawk, pin3ska, black ant, qwert666, ua and gacmaan DIRECTORY TRAVERSAL http://victim.com/?p=ONE OF THE EXISITING FILES-EXISITING ACTION IN THIS FILE- Most of actions load templates form bad directory and then thr...
QuickCart 3.x - Cross-Site Scripting / Cross-Site Request Forgery / Local File Inclusion / Directory Traversal
DISCOVERED: PaweÅ‚ 'kl3ryk' Åaskarzewski GREETZ: hawk, pin3ska, black ant, qwert666, ua and gacmaan DIRECTORY TRAVERSAL http://victim.com/?p=ONE OF THE EXISITING FILES-EXISITING ACTION IN THIS FILE- Most of actions load templates form bad directory and then throw an exception. example:...
CVE-2009-3255
SQL injection vulnerability in RASH Quote Management System RQMS 1.2.2 and earlier, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the user parameter in an admin action to the default URI...
CVE-2009-3255: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in RASH Quote Management System RQMS 1.2.2 and earlier, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the user parameter in an admin action to the default URI...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in Lightweight news portal LNP 1.0b allow remote attackers to inject arbitrary web script or HTML via the 1 photo parameter to showphoto.php, 2 potd parameter to showpotd.php, or 3 the Current question field in a vote action to admin.php...
CVE-2008-0723
Cross-site scripting XSS vulnerability in mynews.inc.php in MyNews 1.6.4, and other earlier 1.6.x versions, allows remote attackers to inject arbitrary web script or HTML via the hash parameter in an admin action to index.php, a different vulnerability than CVE-2006-2208.1...
CVE-2008-0723: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in mynews.inc.php in MyNews 1.6.4, and other earlier 1.6.x versions, allows remote attackers to inject arbitrary web script or HTML via the hash parameter in an admin action to index.php, a different vulnerability than CVE-2006-2208.1...
Code injection
cpie.php in XCMS 1.83 and earlier sends a redirect to the web browser but does not exit, which allows remote attackers to conduct direct static code injection attacks and execute arbitrary code via the testo0 parameter in a cpie admin action to index.php, which writes to dati/generali/footer.dtb...
CVE-2007-6652
cpie.php in XCMS 1.83 and earlier sends a redirect to the web browser but does not exit, which allows remote attackers to conduct direct static code injection attacks and execute arbitrary code via the testo0 parameter in a cpie admin action to index.php, which writes to dati/generali/footer.dtb...
CVE-2007-5374
cpmemberedit.php in LightBlog 8.4.1.1 does not check for administrative credentials when processing an admin action, which allows remote authenticated users to increase the privileges of any account...
CVE-2007-5060
CVE-2007-5060 describes a CSRF vulnerability in XCMS within the admin action for index.php, affecting the cpass functionality. It allows remote attackers to change arbitrary passwords by submitting certain password_ and rpassword_ parameters, possibly related to timestamp values. The issue stems ...