BrudaNews <= 1.1 (admin/index.php) Remote File Include Vulnerability

No description provided by source. ============================================================================================== BrudaNews = v1.1 o Remote File Inclusion Exploit =============================================================================================== Critical Level :...

Allomani Super Multimedia Library 2.5.0 - CSRF Vulnerability (Add Admin)

No description provided by source. Super Multimedia Library 2.5.0 XSRF Vulnerability Add Admin ==================================================================== .:. Author : AtT4CKxT3rR0r1ST [email protected] .:. Script : http://allomani.com/en/mediascript.html === Exploit === form method=POST...

PHPFaber TopSites 3 Admin/Index.PHP Directory Traversal Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/23419/info TopSites is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable...

KDPics 1.18 'admin/index.php' Authentication Bypass Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/38603/info KDPics is prone to a vulnerability that lets an attacker add an administrative user because it fails to adequately secure access to administrative functionality. This may allow the attacker to compromise the...

couponPHP CMS 1.0 Multiple Stored XSS and SQL Injection Vulnerabilities

Summary couponPHP is a revolutionary content management system for running Coupon and Deal websites. It is feature rich, powerful, beautifully designed and fully automatic. Description couponPHP is vulnerable to multiple Stored XSS and SQL Injection issues. Input passed via the parameters...

CVE-2012-6631

Cross-site request forgery CSRF vulnerability in accounts/admin/index.php in Vessio NetBill 1.2 allows remote attackers to hijack the authentication of administrators for requests that add accounts via a new-client action...

易思espcms某处sql注入漏洞，附详细分析与POC代码

简要描述： 小菜刚学代码审核 详细说明： 文件 /interface/forummain.php中$userid未过滤进入sql语句 第17行到32行 function inlist parent::startpagetemplate; parent::memberpurview0, $this-mlink'orderlist'; includeonce adminROOT . 'public/classpagebotton.php'; $lng = adminLNG == 'big5' ? $this-CON'islancode' : adminLNG; $page =...

Sql injection

SQL injection vulnerability in admin/index.php in Subrion CMS 2.0.4 allows remote attackers to execute arbitrary SQL commands via the 1 user name or 2 password field...

CVE-2012-4232

SQL injection vulnerability in admin/index.php in jCore before 1.0pre2 allows remote attackers to execute arbitrary SQL commands via the memberloginid cookie...

CVE-2012-4232

CVE-2012-4232 is a SQL Injection in jCore before 1.0pre2, exploitable via the cookie value memberloginid in /admin/index.php, allowing remote attackers to execute arbitrary SQL. Related advisory data also notes CVE-2012-4231 (XSS in path parameter) and that the vendor fixed the issue in a subsequ...

CVE-2012-4231

CVE-2012-4231 corresponds to an XSS flaw in jCore’s admin/index.php prior to 1.0pre2. The vulnerability arises from insufficient sanitization of the path parameter in the GET request, allowing an attacker to inject arbitrary HTML/Script that is executed in the victim’s browser (context of the aff...

CVE-2012-1900

CVE-2012-1900 affects RazorCMS 1.2.1 and earlier. The vulnerability is a Cross-Site Request Forgery in admin/index.php that lets remote attackers hijack an administrator’s session to perform showcats actions that delete arbitrary web pages. Root cause: CSRF in the admin interface enabling unautho...

CVE-2011-5212

SQL injection vulnerability in admin/index.php in Subrion CMS 2.0.4 allows remote attackers to execute arbitrary SQL commands via the 1 user name or 2 password field...

CVE-2012-5228

Cross-site scripting XSS vulnerability in admin/index.php in phplist 2.10.9, 2.10.17, and possibly other versions before 2.10.19 allows remote attackers to inject arbitrary web script or HTML via the testtarget parameter. NOTE: some of these details are obtained from third party information...

CVE-2012-5228

CVE-2012-5228 is a cross-site scripting (XSS) vulnerability in admin/index.php of phplist, affecting 2.10.9 and 2.10.17 (and possibly other versions prior to 2.10.19). The issue allows remote attackers to inject arbitrary web script or HTML via the testtarget parameter. The connected documents co...

Sql injection

SQL injection vulnerability in admin/index.php in phpList before 2.10.19 allows remote administrators to execute arbitrary SQL commands via the delete parameter to the editattributes page...

CVE-2012-3952

CVE-2012-3952 is an XSS vulnerability in phpList 2.10.18 and earlier, occurring in admin/index.php when the unconfirmed parameter is used (page=user). Exploitation can cause arbitrary HTML/script execution in an administrator’s browser. The related advisory confirms a fixed vendor patch: upgrade ...

CVE-2012-3836

Multiple cross-site scripting XSS vulnerabilities in Baby Gekko before 1.2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 groupname parameter in a savecategory in the users module; 2 virtualfilename, 3 branch, 4 contactperson, 5 street, 6 city, 7 province, 8 postal, 9...

Kuwebs 3.1.3 admin-index.php参数menu远程文件包含漏洞

No description provided by source...

CVE-2012-0997

Cross-site request forgery CSRF vulnerability in admin/index.php in 11in1 1.2.1 stable 12-31-2011 allows remote attackers to hijack the authentication of administrators for requests that add new topics via an addTopic action...