CVE-2013-3728

CVE-2013-3728 affects Kasseler CMS prior to 2 r1232. The connected sources document three vulnerabilities in Kasseler CMS: stored XSS via the cat parameter in admin.php (admin_new_category action), general XSS, and CSRF allowing SQL execution. Specifically, remote authenticated users with categor...

PT-2014-2706

Name of the Vulnerable Software and Affected Versions Kasseler CMS versions prior to 2 r1232 Description The issue allows remote authenticated users with permissions to create categories to inject arbitrary web script or HTML via the cat parameter in an "admin new category" action to "admin.php"...

PT-2014-2705

Name of the Vulnerable Software and Affected Versions Kasseler CMS versions prior to 2 r1232 Description The issue allows remote authenticated users to execute arbitrary SQL commands via the groups parameter to "admin.php". This can be leveraged using CSRF to allow remote unauthenticated attacker...

PT-2014-2707

Name of the Vulnerable Software and Affected Versions Kasseler CMS versions prior to 2 r1232 Description The issue allows remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks. This can be achieved via the groups parameter in a send action...

CVE-2013-3729: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in Kasseler CMS before 2 r1232 allow remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the 1 groups parameter in a send action in the sendmail module or 2 query parameter in ...

CVE-2013-3728: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Kasseler CMS before 2 r1232 allows remote authenticated users with permissions to create categories to inject arbitrary web script or HTML via the cat parameter in an adminnewcategory action to admin.php...

CVE-2013-3727: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Kasseler CMS before 2 r1232 allows remote authenticated users to execute arbitrary SQL commands via the groups parameter to admin.php. NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands...

OpenSupports Remote Shell Upload Vulnerability

Sites powered by OpenSupports suffer from a remote shell upload vulnerability. Exploit Title: Open Support Arbitrary Remote File Upload Vulnerabilities Google Dork: allintext: "Power by OpenSupports © 2009 - 2014. All Rights reserved" Date: 02,March 02,2014 Exploit Author: Slotleet Vendor Homepag...

Singapore 0.9.9b / 0.9.10 Cross Site Scripting

Author: TUNISIAN CYBER + Exploit Title: singapore v0.9.9b/0.9.10 admin.php POST Cross Site Scripting Vulnerability + Date: 05-02-2014 + Category: WebApp + Google Dork: : + Tested on: KaliLinux + Vendor: http://sourceforge.net/projects/singapore/ + Friendly Sites: na3il.com,th3-creative.com...

PT-2014-2506

Name of the Vulnerable Software and Affected Versions LeagueManager plugin versions prior to 3.8.1 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the league id parameter in the "leaguemanager-export" page to "wp-admin/admin.php"...

Cross site scripting

Cross-site scripting XSS vulnerability in fs-admin/wpf-add-forum.php in the ForumPress WP Forum Server plugin before 1.7.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the groupid parameter in an addforum action to wp-admin/admin.php...

CVE-2012-6623

Cross-site scripting XSS vulnerability in fs-admin/wpf-add-forum.php in the ForumPress WP Forum Server plugin before 1.7.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the groupid parameter in an addforum action to wp-admin/admin.php...

CVE-2012-6625

CVE-2012-6625 affects the ForumPress WP Forum Server plugin for WordPress, specifically the fs-admin/fs-admin.php component. The vulnerability is a SQL injection via the groupid parameter in an editgroup action, exploitable remotely and leading to arbitrary SQL execution. It applies to plugin ver...

CVE-2012-6622

Multiple cross-site scripting XSS vulnerabilities in fs-admin/fs-admin.php in the ForumPress WP Forum Server plugin before 1.7.4 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 groupid parameter in an editgroup action or 2 usergroupid parameter in an...

CVE-2012-6625: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in fs-admin/fs-admin.php in the ForumPress WP Forum Server plugin before 1.7.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the groupid parameter in an editgroup action...

CVE-2012-6622: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in fs-admin/fs-admin.php in the ForumPress WP Forum Server plugin before 1.7.4 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 groupid parameter in an editgroup action or 2 usergroupid parameter in an...

PT-2014-2392

Name of the Vulnerable Software and Affected Versions ForumPress WP Forum Server plugin versions prior to 1.7.5 Description The issue is related to a cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary web script or HTML via the groupid parameter in an 'addforum...

CVE-2013-6797

Cross-site request forgery CSRF vulnerability in bluewrench-video-widget.php in the Blue Wrench Video Widget plugin before 2.0.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that embed arbitrary URLs via the bwurl parameter in the bw-videos pag...

CVE-2013-6797

CVE-2013-6797 is a CSRF vulnerability in the WordPress plugin Blue Wrench Video Widget (bluewrench-video-widget.php) prior to version 2.0.0 . The issue allows remote attackers to hijack an administrator’s session by crafting requests that embed arbitrary URLs via the bw_url parameter on the bw-vi...

PT-2013-6114

Name of the Vulnerable Software and Affected Versions Blue Wrench Video Widget plugin versions prior to 2.0.0 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that embed arbitrary URLs via the bw url parameter ...