CVE-2011-0642: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in news/admin.php in N-13 News 3.4, 3.7, and 4.0 allows remote attackers to hijack the authentication of administrators for requests that create new users via the options action. NOTE: some of these details are obtained from third party information...

CVE-2011-0641: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in wp-admin/admin.php in the StatPressCN plugin 1.9.0 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 what1, 2 what2, 3 what3, 4 what4, and 5 what5 parameters. NOTE: the provenance of this information is...

N - 1 3 news 3.4 remote admin add CSRF vulnerability-vulnerability warning-the black bar safety net

EXP: the html head titleRemote Admin Add CSRF Exploit/title /head H2Remote Admin Add CSRF Exploit by qing-Edit/H2 formmethod="POST"name="form0"action="http://localhost/news/admin.php?action=options&mod=accounts&create=new" inputtype="hidden"name="accountname"value="admin" /...

CVE-2010-4613

Multiple directory traversal vulnerabilities in Hycus CMS 1.0.3 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the site parameter to 1 index.php and 2 admin.php...

CVE-2010-4613

Multiple directory traversal vulnerabilities in Hycus CMS 1.0.3 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the site parameter to 1 index.php and 2 admin.php...

PT-2010-5579

Name of the Vulnerable Software and Affected Versions Hycus CMS version 1.0.3 Description The issue allows remote attackers to include and execute arbitrary local files. This is achieved by exploiting directory traversal vulnerabilities using a .. dot dot in the "site" parameter to specific API...

CVE-2010-4613: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in Hycus CMS 1.0.3 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the site parameter to 1 index.php and 2 admin.php...

CVE-2010-4275

Multiple cross-site scripting XSS vulnerabilities in Radius Manager 3.8.0 allow remote authenticated administrators to inject arbitrary web script or HTML via the 1 name or 2 descr parameter in an a updateusergroup or a b storenas action to admin.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Radius Manager 3.8.0 allow remote authenticated administrators to inject arbitrary web script or HTML via the 1 name or 2 descr parameter in an a updateusergroup or a b storenas action to admin.php...

CVE-2010-4275

Radius Manager 3.8.0 is affected by multiple stored XSS vulnerabilities. The issue arises in the admin.php actions update_usergroup and store_nas, where unsanitized inputs for name/descr can inject arbitrary script/HTML. Exploitation requires an authenticated administrator; impact is limited to t...

PT-2010-5393

Name of the Vulnerable Software and Affected Versions Radius Manager version 3.8.0 Description The issue allows remote authenticated administrators to inject arbitrary web script or HTML. This can be achieved via the name or descr parameter in an "update usergroup" or "store nas" action to...

CVE-2010-4275: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Radius Manager 3.8.0 allow remote authenticated administrators to inject arbitrary web script or HTML via the 1 name or 2 descr parameter in an a updateusergroup or a b storenas action to admin.php...

CMScout 2.09 Cross Site Request Forgery

Vulnerability ID: HTB22719 Reference: http://www.htbridge.ch/advisory/xsrfcsrfincmscout.html Product: CMScout Vendor: CMScout Team http://www.cmscout.co.za/ Vulnerable Version: 2.09 and probably prior versions Vendor Notification: 25 November 2010 Vulnerability Type: CSRF Cross-Site Request Forge...

Diferior 8.03 - Multiple Cross-Site Scripting Vulnerabilities

Diferior 8.03 - Multiple Cross-Site Scripting Vulnerabilities Vulnerability ID: HTB22721 Reference: http://www.htbridge.ch/advisory/storedxsscrosssitescriptingvulnerabilityindiferior.html Product: Diferior Vendor: Povilas Musteikis http://www.diferior.com/ Vulnerable Version: 8.03 and probably...

Jamb - Cross-Site Request Forgery (Add a Post)

!/usr/bin/python /\ \ /\ \ /'\ /\ \ \ \ /\ \ /\//\ \ /\ /\ \ \ \ \ \ \ \ \ /'\ /\ /\ \ \ \ /'\ \ \ \ \ /' \ /'\ /'\''\ /\ /\ \ \ \ \ \ / \ / | \ \\ /\ /\ \ \ \ \L\ /\ / /\ / \ /\ / \ / / \ \ / \ / \ \\ \\ / ,\ \ \ \ \ \ \x/' // //// ////// // /, ///...

nileweb School CMS injection vulnerability and repair programme-vulnerability warning-the black bar safety net

nileweb School CMS program index. php parameter filtering is not strictly the presence of injection vulnerabilities. Batch google. cn inurl:index. php? action= http://localhost/index.php?action=cms/showpaget&pageid=-21+/! uniOn/+select+1,convertgrOupcOncatusername,0x3a,password using...

Jax Guestbook admin bypass vulnerability

Exploit for php platform in category web applications ======================================== Jax Guestbook admin bypass vulnerability ======================================== Exploit Title: Jax Guestbook admin bypass vulnerability Date: 3.10.2010 Author: EraGoN Software...

Sql injection

Multiple SQL injection vulnerabilities in wpQuiz 2.7 allow remote attackers to execute arbitrary SQL commands via the 1 id and 2 password pw parameters to a admin.php or b user.php...

CVE-2010-3608

Multiple SQL injection vulnerabilities in wpQuiz 2.7 allow remote attackers to execute arbitrary SQL commands via the 1 id and 2 password pw parameters to a admin.php or b user.php...

CVE-2010-3608: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in wpQuiz 2.7 allow remote attackers to execute arbitrary SQL commands via the 1 id and 2 password pw parameters to a admin.php or b user.php...