CVE-2015-1373

Multiple cross-site scripting XSS vulnerabilities in admin.php in ferretCMS 1.0.4-alpha allow remote attackers to inject arbitrary web script or HTML via the 1 action parameter in a search request, 2 username in a login request, which is not properly handled when logging the event, or 3 page titl...

CVE-2015-1372

SQL injection vulnerability in ferretCMS 1.0.4-alpha allows remote attackers to execute arbitrary SQL commands via the p parameter in an update action to admin.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in admin.php in ferretCMS 1.0.4-alpha allow remote attackers to inject arbitrary web script or HTML via the 1 action parameter in a search request, 2 username in a login request, which is not properly handled when logging the event, or 3 page titl...

Sql injection

SQL injection vulnerability in ferretCMS 1.0.4-alpha allows remote attackers to execute arbitrary SQL commands via the p parameter in an update action to admin.php...

CVE-2015-1373

Multiple cross-site scripting XSS vulnerabilities in admin.php in ferretCMS 1.0.4-alpha allow remote attackers to inject arbitrary web script or HTML via the 1 action parameter in a search request, 2 username in a login request, which is not properly handled when logging the event, or 3 page titl...

CVE-2015-1373

The CVE-2015-1373 entry concerns ferretCMS 1.0.4-alpha, where multiple XSS vulnerabilities exist in admin.php. The attacker can inject arbitrary script/HTML through: (1) the action parameter in a search request, (2) the username in a login request that is not properly handled when logging the eve...

PT-2015-5249

Name of the Vulnerable Software and Affected Versions ferretCMS version 1.0.4-alpha Description The issue concerns multiple cross-site request forgery CSRF vulnerabilities in the admin.php file. These vulnerabilities allow remote attackers to hijack the authentication of administrators, potential...

CVE-2015-1372: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in ferretCMS 1.0.4-alpha allows remote attackers to execute arbitrary SQL commands via the p parameter in an update action to admin.php...

CVE-2015-1373: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in admin.php in ferretCMS 1.0.4-alpha allow remote attackers to inject arbitrary web script or HTML via the 1 action parameter in a search request, 2 username in a login request, which is not properly handled when logging the event, or 3 page titl...

CVE-2015-1374: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in admin.php in ferretCMS 1.0.4-alpha allow remote attackers to hijack the authentication of administrators for requests that conduct 1 cross-site scripting XSS, 2 SQL injection, or 3 unrestricted file upload attacks...

PT-2015-5247

Name of the Vulnerable Software and Affected Versions ferretCMS version 1.0.4-alpha Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the p parameter in an update action to the "admin.php" endpoint. Recommendations For...

WordPress Photo Gallery plugin <= 1.2.100 - SQL Injection

Because of this vulnerability, authenticated users can execute arbitrary SQL commands via "the ascordesc" parameter in the galleriesbwg page to wp-admin/admin.php. Solution Upgrade the plugin...

CVE-2015-1204

Cross-site scripting XSS vulnerability in the Save Filters functionality in the WP Slimstat plugin before 3.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the fsresource parameter in the wp-slim-view-2 page to wp-admin/admin.php...

CVE-2015-1204: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Save Filters functionality in the WP Slimstat plugin before 3.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the fsresource parameter in the wp-slim-view-2 page to wp-admin/admin.php...

PT-2015-5162

Name of the Vulnerable Software and Affected Versions WP Slimstat plugin versions prior to 3.9.2 Description A cross-site scripting XSS issue exists in the Save Filters functionality of the WP Slimstat plugin. This allows remote attackers to inject arbitrary web script or HTML via the fsresource...

PT-2015-4303

Name of the Vulnerable Software and Affected Versions b2evolution versions prior to 5.2.1 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the fm filter parameter to the "blogs/admin.php" API endpoint...

CVE-2014-9599: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the filemanager in b2evolution before 5.2.1 allows remote attackers to inject arbitrary web script or HTML via the fmfilter parameter to blogs/admin.php...

CVE-2014-7957: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the Pods plugin before 2.5 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 conduct cross-site scripting XSS attacks via the toggled parameter in a toggle action in the pods-componen...

CVE-2014-7956: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Pods plugin before 2.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter in an edit action in the pods page to wp-admin/admin.php...

PT-2015-3982

Name of the Vulnerable Software and Affected Versions Pods plugin versions prior to 2.5 for WordPress Description The issue allows remote attackers to hijack the authentication of administrators for various requests, including conducting cross-site scripting XSS attacks, deleting pods, resetting...