CVE-2010-5285

Cross-site request forgery CSRF vulnerability in admin.php in Collabtive 0.6.5 allows remote attackers to hijack the authentication of administrators for requests that add administrative users via the edituser action...

CVE-2010-5285

CVE-2010-5285 describes a Cross‑Site Request Forgery (CSRF) in Collabtive 0.6.5, affecting admin.php via the edituser action. The vulnerability allows a remote attacker to hijack administrators’ authentication and perform actions that add new administrative users. This is tied to the specific ver...

CVE-2010-5285

Cross-site request forgery CSRF vulnerability in admin.php in Collabtive 0.6.5 allows remote attackers to hijack the authentication of administrators for requests that add administrative users via the edituser action...

CVE-2010-5285: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in admin.php in Collabtive 0.6.5 allows remote attackers to hijack the authentication of administrators for requests that add administrative users via the edituser action...

PT-2012-1495

Name of the Vulnerable Software and Affected Versions Collabtive version 0.6.5 Description A cross-site request forgery issue exists, allowing remote attackers to hijack administrator authentication for requests that add administrative users via the "edituser" action in admin.php. Recommendations...

Multi-Page Comment System CSRF/XSS Vulnerability

Exploit for php platform in category web applications 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 +...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in wlcms-plugin.php in the White Label CMS plugin before 1.5.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that modify the developer name via the wlcmsodevelopername parameter in a save action to...

CVE-2012-5388

Cross-site scripting XSS vulnerability in wlcms-plugin.php in the White Label CMS plugin 1.5 for WordPress allows remote authenticated administrators to inject arbitrary web script or HTML via the wlcmsodevelopername parameter in a save action to wp-admin/admin.php, a related issue to CVE-2012-53...

PT-2012-5969

Name of the Vulnerable Software and Affected Versions White Label CMS plugin versions prior to 1.5.1 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that modify the developer name via the wlcms o developer nam...

CVE-2012-5387: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in wlcms-plugin.php in the White Label CMS plugin before 1.5.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that modify the developer name via the wlcmsodevelopername parameter in a save action to...

Sql injection

Multiple SQL injection vulnerabilities in the Mingle Forum plugin 1.0.32.1 and other versions before 1.0.33 for WordPress might allow remote authenticated users to execute arbitrary SQL commands via the 1 memberid or 2 groupid parameters in a removemember action or 3 id parameter to...

Sql injection

Multiple SQL injection vulnerabilities in fs-admin/fs-admin.php in the Mingle Forum plugin 1.0.32.1 and other versions before 1.0.33 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the 1 deleteusrgrp parameter in a deleteusergroups action, 2 usergroup paramete...

CVE-2010-5064

Multiple cross-site scripting XSS vulnerabilities in Virtual War aka VWar 1.6.1 R2 allow remote attackers to inject arbitrary web script or HTML via 1 the Additional Information field to challenge.php, the 2 Additional Information or 3 Contact information field to joinus.php, 4 the War Report fie...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Virtual War aka VWar 1.6.1 R2 allow remote attackers to inject arbitrary web script or HTML via 1 the Additional Information field to challenge.php, the 2 Additional Information or 3 Contact information field to joinus.php, 4 the War Report fie...

CVE-2010-5064

Multiple cross-site scripting XSS vulnerabilities in Virtual War aka VWar 1.6.1 R2 allow remote attackers to inject arbitrary web script or HTML via 1 the Additional Information field to challenge.php, the 2 Additional Information or 3 Contact information field to joinus.php, 4 the War Report fie...

CVE-2012-5327: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in fs-admin/fs-admin.php in the Mingle Forum plugin 1.0.32.1 and other versions before 1.0.33 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the 1 deleteusrgrp parameter in a deleteusergroups action, 2 usergroup paramete...

PT-2012-1317

Name of the Vulnerable Software and Affected Versions Virtual War aka VWar version 1.6.1 R2 Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting XSS attacks. This can be achieved through various fields, including the...

PT-2012-5927

Name of the Vulnerable Software and Affected Versions Mingle Forum plugin versions prior to 1.0.33 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This can be achieved via the memberid or groupid parameters in a "removemember" action, the id parameter to...

PT-2012-2993

Name of the Vulnerable Software and Affected Versions KnowledgeTree versions 3.7.0.2 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML via the PATH INFO to specific API endpoints, including "login.php", "admin.php", or "preferences.php". This can be...

Sql injection

SQL injection vulnerability in admin/admin.php in LimeSurvey before 1.91+ Build 120224 allows remote authenticated users to execute arbitrary SQL commands via the id parameter in a browse action. NOTE: some of these details are obtained from third party information...