CVE-2012-4995

Cross-site scripting XSS vulnerability in admin/userrighthandling.php in LimeSurvey before 1.91+ Build 120224 allows remote attackers to inject arbitrary web script or HTML via the fullname parameter in a moduser action to admin/admin.php. NOTE: some of these details are obtained from third party...

CVE-2012-4994

The CVE-2012-4994 entry concerns a SQL injection in LimeSurvey’s admin/admin.php. Affected software is LimeSurvey prior to 1.91+ Build 120224, where remote authenticated users can inject SQL commands via the id parameter in a browse action. The vulnerability arises from improper sanitization of u...

CVE-2012-4994

SQL injection vulnerability in admin/admin.php in LimeSurvey before 1.91+ Build 120224 allows remote authenticated users to execute arbitrary SQL commands via the id parameter in a browse action. NOTE: some of these details are obtained from third party information...

PT-2012-5712

Name of the Vulnerable Software and Affected Versions LimeSurvey versions prior to 1.91+ Build 120224 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the id parameter in a "browse" action in the admin/admin.php file. Recommendations...

PT-2012-5713

Name of the Vulnerable Software and Affected Versions LimeSurvey versions prior to 1.91+ Build 120224 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the full name parameter in a moduser action to "admin/admin.php". Recommendations F...

CVE-2012-4994: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/admin.php in LimeSurvey before 1.91+ Build 120224 allows remote authenticated users to execute arbitrary SQL commands via the id parameter in a browse action. NOTE: some of these details are obtained from third party information...

CVE-2012-4036

Unrestricted file upload vulnerability in admin.php in PBBoard 2.1.4 allows remote administrators to execute arbitrary PHP code by uploading a file with an executable extension, then accessing it via a direct request to the file in the addons directory. NOTE: this vulnerability can be leveraged b...

CVE-2012-4036: Undefined Security Weakness

Unrestricted file upload vulnerability in admin.php in PBBoard 2.1.4 allows remote administrators to execute arbitrary PHP code by uploading a file with an executable extension, then accessing it via a direct request to the file in the addons directory. NOTE: this vulnerability can be leveraged b...

CVE-2012-2209

Multiple cross-site scripting XSS vulnerabilities in admin.php in Piwigo before 2.3.4 allow remote attackers to inject arbitrary web script or HTML via the 1 section parameter in the configuration module, 2 installstatus parameter in the languagesnew module, or 3 theme parameter in the theme modu...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in admin.php in Piwigo before 2.3.4 allow remote attackers to inject arbitrary web script or HTML via the 1 section parameter in the configuration module, 2 installstatus parameter in the languagesnew module, or 3 theme parameter in the theme modu...

CVE-2012-2209

CVE-2012-2209 affects Piwigo prior to 2.3.4, exposing multiple XSS vulnerabilities in admin.php via the section, installstatus, and theme parameters. The issue enables remote attackers to inject arbitrary HTML/script in an administrator session. Vendor patch: upgrade to Piwigo 2.3.4 (remediation)...

CVE-2012-2209

Multiple cross-site scripting XSS vulnerabilities in admin.php in Piwigo before 2.3.4 allow remote attackers to inject arbitrary web script or HTML via the 1 section parameter in the configuration module, 2 installstatus parameter in the languagesnew module, or 3 theme parameter in the theme modu...

CVE-2012-2209: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in admin.php in Piwigo before 2.3.4 allow remote attackers to inject arbitrary web script or HTML via the 1 section parameter in the configuration module, 2 installstatus parameter in the languagesnew module, or 3 theme parameter in the theme modu...

PT-2012-5307

Name of the Vulnerable Software and Affected Versions Free Realty versions 3.1-0.6 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the view parameter to "agentdisplay.php" or the edit parameter to "admin/admin.php". Recommendations For Fre...

PT-2012-3958

Name of the Vulnerable Software and Affected Versions Serendipity versions prior to 1.6.1 Description The issue allows remote attackers to execute arbitrary SQL commands via the serendipityplugin to conf parameter in the serendipity admin.php file. This might be related to cross-site request...

CVE-2012-4279: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Free Realty 3.1-0.6 allow remote attackers to execute arbitrary SQL commands via the 1 view parameter to agentdisplay.php or 2 edit parameter to admin/admin.php...

Classifieds Ads Script PHP 1.1 SQL Injection

Title: ====== Classified Ads Script PHP v1.1 - SQL Injection Vulnerabilities Date: ===== 2012-06-13 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=605 VL-ID: ===== 605 Common Vulnerability Scoring System: ==================================== 5.5 Introduction:...

Event Calendar PHP 1.2 - Multiple Web Vulnerabilities

Document Title: =============== Event Calendar PHP 1.2 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=607 Release Date: ============= 2012-06-18 Vulnerability Laboratory ID VL-ID: ==================================== 607...

AdaptCMS 2.0.2 TinyURL Plugin - admin.php Multiple SQL Injections

AdaptCMS 2.0.2 TinyURL Plugin - admin.php Multiple SQL Injections source: https://www.securityfocus.com/bid/53764/info AdaptCMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues...

PBBoard v2.1.4 (CSRF) Arbitrary File Upload and Command Execution (MSF

Exploit for php platform in category web applications 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 +...