CVE-2017-17826

The Configuration component of Piwigo 2.9.2 is vulnerable to Persistent Cross Site Scripting via the gallerytitle parameter in an admin.php?page=configuration&section=main request. An attacker can exploit this to hijack a client's browser along with the data stored in it...

CVE-2017-17825

The Batch Manager component of Piwigo 2.9.2 is vulnerable to Persistent Cross Site Scripting via tags- array parameters in an admin.php?page=batchmanager&mode=unit request. An attacker can exploit this to hijack a client's browser along with the data stored in it...

CVE-2017-17825

The Batch Manager component of Piwigo 2.9.2 is vulnerable to Persistent Cross Site Scripting via tags- array parameters in an admin.php?page=batchmanager&mode=unit request. An attacker can exploit this to hijack a client's browser along with the data stored in it...

CVE-2017-17826

The Configuration component of Piwigo 2.9.2 is vulnerable to Persistent Cross Site Scripting via the gallerytitle parameter in an admin.php?page=configuration&section=main request. An attacker can exploit this to hijack a client's browser along with the data stored in it...

CVE-2017-17775

Piwigo 2.9.2 has XSS via the name parameter in an admin.php?page=album-3-properties request...

CVE-2017-17775

Piwigo 2.9.2 has XSS via the name parameter in an admin.php?page=album-3-properties request...

Piwigo 'name' Parameter Cross-Site Scripting Vulnerability

Piwigo is a web-based photo album software from Piwigo team. The software supports photo publishing, management, multiple browsing category, tag, time, etc. Batch Manager component is one of the manager components. A cross-site scripting vulnerability exists in Piwigo version 2.9.2. A remote...

Bus Booking Script SQL Injection Vulnerability

Bus Booking Script is an online bus booking management system based on PHP and MySQL. A SQL injection vulnerability exists in Bus Booking Script version 1.0. The vulnerability can be exploited to inject SQL commands by sending the 'txtname' parameter to the admin/index.php file...

Sql injection

Bus Booking Script 1.0 has SQL Injection via the txtname parameter to admin/index.php...

PT-2017-15702 · D Link · D-Link Dir-330 +1

Name of the Vulnerable Software and Affected Versions: D-Link DIR-130 version 1.23 D-Link DIR-330 version 1.12 Description: The issue concerns insufficient protection of administrator credentials. Specifically, the tools admin.asp page returns the administrator password in base64 encoding, allowi...

WordPress amtyThumb amty-thumb-recent-post plugin cross-site scripting vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, which supports setting up personal blog sites on servers with PHP and MySQL. amtyThumb amty-thumb-recent-post also known as amtyThumb posts or wp-thumb- post plugin is used in one of the...

SQL Injection Vulnerability in phpaaCMS v0.5 admin/friendlink.add.php Page

phpaaCMS is a simple article management system. A SQL injection vulnerability exists in the admin/friendlink.add.php page of phpaaCMS v0.5, which can be exploited by attackers to obtain sensitive information from the database...

CVE-2017-17059

XSS exists in the amtyThumb amty-thumb-recent-post aka amtyThumb posts or wp-thumb-post plugin 8.1.3 for WordPress via the query string to amtyThumbPostsAdminPg.php...

SQL injection vulnerability in the program\diypage\show\admin.php page of the Monxin enterprise station-building system program\diypage\show\admin.php

Monxin Enterprise Station Building System is a self-service station building system based on PHP language development. A SQL injection vulnerability exists in the program\diypage\show\admin.php page of the Monxin Enterprise Station Building System. The vulnerability is due to the system fails to...

Popular Pentesting Scanner: v3n0m

v3n0m is a free and open source scanner. Evolved from baltazar’s scanner, it has adapted several new features that improve functionality and usability. It is mostly experimental software. This program is for finding and executing various vulnerabilities. It scavenges the web using dorks and...

Cross site scripting

In admin/write-post.php in Typecho through 1.1, one can log in to the background page, write a new article, and add payload in the article content, resulting in XSS via index.php/action/contents-post-edit...

CVE-2017-15976

ZeeBuddy 2x allows SQL Injection via the admin/editadgroup.php groupid parameter, a different vulnerability than CVE-2008-3604...

CVE-2017-15809

In phpMyFaq before 2.9.9, there is XSS in admin/tags.main.php via a crafted tag...

CVE-2017-15809

In phpMyFaq before 2.9.9, there is XSS in admin/tags.main.php via a crafted tag...

CVE-2017-15809

In phpMyFaq before 2.9.9, there is XSS in admin/tags.main.php via a crafted tag...