Design/Logic Flaw

The Search Autocomplete module 7.x-2.x before 7.x-2.4 for Drupal does not properly restrict access to the module admin page, which allows remote attackers to disable an autocompletion or change the priority order via unspecified vectors...

Sql injection

SQL injection vulnerability in admin/index.php in jCore before 1.0pre2 allows remote attackers to execute arbitrary SQL commands via the memberloginid cookie...

Cross site scripting

Cross-site scripting XSS vulnerability in admin/index.php in jCore before 1.0pre2 allows remote attackers to inject arbitrary web script or HTML via the path parameter...

CVE-2012-4990

SQL injection vulnerability in admin/campaign-zone-link.php in OpenX 2.8.10 before revision 81823 allows remote attackers to execute arbitrary SQL commands via the ids parameter in a link action...

CVE-2012-4994

SQL injection vulnerability in admin/admin.php in LimeSurvey before 1.91+ Build 120224 allows remote authenticated users to execute arbitrary SQL commands via the id parameter in a browse action. NOTE: some of these details are obtained from third party information...

Sql injection

SQL injection vulnerability in admin/country/edit.php in Newscoop before 3.5.5 and 4.x before 4 RC4 allows remote attackers to execute arbitrary SQL commands via the fcountrycode parameter...

PT-2012-5161 · Pbboard · Pbboard

Name of the Vulnerable Software and Affected Versions: PBBoard version 2.1.4 Description: The issue allows remote administrators to execute arbitrary PHP code by uploading a file with an executable extension to the addons directory via admin.php, and then accessing it directly. This can be...

Information disclosure

The Add Member dialog in the Security admin page in SilverStripe 2.4.0 saves user passwords in plaintext, which allows local users to obtain sensitive information by reading a database...

CVE-2010-5092

The CVE-2010-5092 issue affects SilverStripe 2.4.0 where the Add Member dialog stores passwords in plain text, enabling local information disclosure by reading the database. Root cause: plaintext password storage. Remediation: upgrade to a fixed release (e.g., SilverStripe 2.4.1) as indicated by ...

CVE-2012-4238

Cross-site scripting XSS vulnerability in admin/code/tceeditanswer.php in TCExam before 11.3.008 allows remote authenticated users with level 5 or greater permissions to inject arbitrary web script or HTML via the questionsubjectid parameter...

DEBIAN-CVE-2012-2768

Multiple cross-site scripting XSS vulnerabilities in the topic administration page in the RTFM extension 2.0.4 through 2.4.3 for Best Practical Solutions RT allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-3953

SQL injection vulnerability in admin/index.php in phpList before 2.10.19 allows remote administrators to execute arbitrary SQL commands via the delete parameter to the editattributes page...

CVE-2012-3953

SQL injection vulnerability in admin/index.php in phpList before 2.10.19 allows remote administrators to execute arbitrary SQL commands via the delete parameter to the editattributes page...

YourArcadeScript 2.4beta default admin Vulnerablity

Exploit for php platform in category web applications Exploit Title: YourArcadeScript 2.4beta default admin Vulnerablity author : gilang vendor : www.yourarcadescript.com risk : high type : webapps / 0day php Date: 07-11-2012 Version:2.4beta google dork : YourArcadeScript 2.4beta Contact:...

GuestBook Scripts PHP v1.5 - Multiple Web Vulnerabilites

Title: ====== GuestBook Scripts PHP v1.5 - Multiple Web Vulnerabilites Date: ===== 2012-06-11 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=601 VL-ID: ===== 601 Common Vulnerability Scoring System: ==================================== 7.5 Introduction: =============...

CVE-2012-3833

Cross-site scripting XSS vulnerability in the default index page in admin/ in Quick.CMS 4.0 allows remote attackers to inject arbitrary web script or HTML via the p parameter...

CVE-2012-3833

CVE-2012-3833 is a Cross-site Scripting (XSS) vulnerability in the default index page under admin/ in Quick.CMS 4.0. The issue enables remote attackers to inject arbitrary web script or HTML via the p parameter in requests. The affected component is the default admin index page; root cause is an ...

CVE-2012-3833

Cross-site scripting XSS vulnerability in the default index page in admin/ in Quick.CMS 4.0 allows remote attackers to inject arbitrary web script or HTML via the p parameter...

GuestBook Scripts PHP v1.5 - Multiple Web Vulnerabilities

Document Title: =============== GuestBook Scripts PHP v1.5 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=601 Release Date: ============= 2012-06-10 Vulnerability Laboratory ID VL-ID: ==================================== 6...

CVE-2012-2912

Multiple cross-site scripting XSS vulnerabilities in the LeagueManager plugin 3.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 group parameter in the show-league page or 2 season parameter in the team page to wp-admin/admin.php...