CVE-2013-5098: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the sort parameter, a different vulnerability than CVE-2013-3262...

PT-2013-5331

Name of the Vulnerable Software and Affected Versions MiniBB versions prior to 3.0.1 Description The issue allows remote attackers to inject arbitrary web script or HTML via the forum name, forum group, forum icon, or forum desc parameters in the bb admin.php file. Recommendations For versions...

CVE-2013-3261: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in wp-admin/admin.php in the GRAND FlAGallery plugin before 2.72 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter in a flag-manage-gallery action...

XOOPS 2.5.6 CSRF Vulnerability

Exploit for php platform in category web applications 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 +...

CVE-2013-3254

Cross-site scripting XSS vulnerability in wp-admin/admin.php in the WP Photo Album Plus plugin before 5.0.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the commentid parameter in a wppamanagecomments edit action...

CVE-2013-3254

The CVE-2013-3254 entry describes a Cross-site Scripting (XSS) vulnerability in the WP Photo Album Plus WordPress plugin's admin interface. Specifically, wp-admin/admin.php is vulnerable in versions before 5.0.3 via the commentid parameter used in the wppa_manage_comments edit action, allowing re...

PT-2013-4257

Name of the Vulnerable Software and Affected Versions WP Photo Album Plus plugin versions prior to 5.0.3 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the commentid parameter in a "wppa manage comments edit" action. This occurs in...

CVE-2013-3254: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in wp-admin/admin.php in the WP Photo Album Plus plugin before 5.0.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the commentid parameter in a wppamanagecomments edit action...

WordPress Download Monitor Plugin <= 3.3.6.1 - XSS #2

Because of this vulnerability in admin/admin.php, the attackers can inject arbitrary web script or HTML via the "p" parameter. Solution Update the plugin...

WordPress GRAND FlAGallery Plugin <= 2.71 - XSS

Because of this vulnerability in wp-admin/admin.php, the attackers can inject arbitrary web script or HTML via the "s" parameter in a flag-manage-gallery action. Solution Update the plugin...

Crafty Syntax Live Help RFI / Path Disclosure

Exploit Title : Crafty Syntax Live Help = 2.. & 3.. RFI + Path Disclosure Date : 4/19/2013 Author : ITTIHACK Home : http://ittihack.com Vendor : http://www.craftysyntax.com Download : http://www.craftysyntax.com/craftysyntax3.4.1.zip Version : 2. and 3. , All versions Category : webapps Google do...

FreeBSD : piwigo -- CSRF/Path Traversal (edd201a5-8fc3-11e2-b131-000c299b62e1)

High-Tech Bridge Security Research Lab reports : The CSRF vulnerability exists due to insufficient verification of the HTTP request origin in '/admin.php' script. A remote attacker can trick a logged-in administrator to visit a specially crafted webpage and create arbitrary PHP file on the remote...

Sql injection

Multiple SQL injection vulnerabilities in admin.php in ChurchCMS 0.0.1 allow remote attackers to execute arbitrary SQL commands via the 1 uname or 2 pass parameters in a login action...

CVE-2012-6507

CVE-2012-6507 affects ChurchCMS 0.0.1: SQL injection vulnerabilities in admin.php allowing remote attackers to execute arbitrary SQL via the login parameters (uname or pass). The root cause is improper input handling in the login action, leading to data exposure/integrity risks. Affected componen...

PT-2013-1975

Name of the Vulnerable Software and Affected Versions Organizer plugin version 1.2.1 for WordPress Description The issue allows remote attackers to inject arbitrary web script or HTML via specific parameters in an "Update Setting" action. The vulnerable parameters are the delete id parameter and...

CVE-2012-6507: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in admin.php in ChurchCMS 0.0.1 allow remote attackers to execute arbitrary SQL commands via the 1 uname or 2 pass parameters in a login action...

CVE-2012-6312

Cross-site scripting XSS vulnerability in the Video Lead Form plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the errMsg parameter in a video-lead-form action to wp-admin/admin.php...

PT-2012-6261

Name of the Vulnerable Software and Affected Versions Video Lead Form plugin for WordPress affected versions not specified Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the errMsg parameter in a "video-lead-form" action t...

PHP-Nuke 8.2.4 - Cross-Site Request Forgery

PHP-Nuke 8.2.4 - Cross-Site Request Forgery Exploit Title:CSRF vulnerability Author: sajith version: PHP Nuke 8.2.4 vulnerable app link:http://phpnuke.org/modules.php?name=Release CSRF add group CSRF POC PHP nuke 8.2.4 document.getElementById'formid'.submit;...

CVE-2012-6312: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Video Lead Form plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the errMsg parameter in a video-lead-form action to wp-admin/admin.php...