311 matches found
CVE-2014-8790: Undefined Security Weakness
XML external entity XXE vulnerability in admin/api.php in GetSimple CMS 3.1.1 through 3.3.x before 3.3.5 Beta 1, when in certain configurations, allows remote attackers to read arbitrary files via the data parameter...
PT-2015-4171
Name of the Vulnerable Software and Affected Versions MantisBT versions 1.1.0a1 through 1.2.x before 1.2.18 Description A cross-site scripting XSS issue exists in the helper api.php file when the Extended project browser is enabled. This allows remote attackers to inject arbitrary web script or...
PT-2014-8614
Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 1.2.18 Description The issue allows remote attackers to obtain sensitive information. This can be achieved via specific SOAP requests, including mc project get users, mc issue get, mc filter get issues, or mc project...
PT-2014-8615
Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 1.2.18 Description The issue is related to a SQL injection vulnerability in the mc project get attachments function. This vulnerability allows remote attackers to execute arbitrary SQL commands via the project id...
UC Gateway Investment SiteEngine 5.0 'api.php' URI Redirection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/31888/info SiteEngine is prone to a remote URI-redirection vulnerability because the application fails to properly sanitize user-supplied input. A successful exploit may aid in phishing-style attacks. SiteEngine 5.0 is...
PT-2014-4254
Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 1.2.16 Description The issue allows remote attackers to execute arbitrary SQL commands via unspecified parameters to various functions, including mc project get attachments in api/soap/mc project api.php, news get...
PT-2014-4253
Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 1.2.16 Description The issue allows remote attackers to execute arbitrary SQL commands via a crafted envelope tag in a "mc issue attachment get" SOAP request. This is due to a SQL injection vulnerability in the mci...
PT-2014-4445
Name of the Vulnerable Software and Affected Versions Media File Renamer plugin version 1.7.0 Description The issue concerns multiple cross-site scripting XSS vulnerabilities in the Media File Renamer plugin for WordPress. These vulnerabilities are found in the callback multicheck, callback radio...
CVE-2014-2244
Cross-site scripting XSS vulnerability in the formatHTML function in includes/api/ApiFormatBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 allows remote attackers to inject arbitrary web script or HTML via a crafted string located after http:// in t...
PT-2014-4580
Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.19.12 MediaWiki versions 1.20.x MediaWiki versions 1.21.x prior to 1.21.6 MediaWiki versions 1.22.x prior to 1.22.3 Description A cross-site scripting XSS issue exists due to a vulnerability in the formatHTML...
CVE-2014-2244: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the formatHTML function in includes/api/ApiFormatBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 allows remote attackers to inject arbitrary web script or HTML via a crafted string located after http:// in t...
Discuz! X2.5 api.php 信息泄露漏洞
Discuz!是国内一套通用的社区论坛软件系统。 Discuz! X2.5 api.php文件中由于arraykeyexists中的第一个参数只能为整数或者字符串，当?mod=ks时，$mod类型为array，从而导致arraykeyexists产生错误信息。 0 Discuz! X2.5...
CVE-2013-4302: Undefined Security Weakness
1 ApiBlock.php, 2 ApiCreateAccount.php, 3 ApiLogin.php, 4 ApiMain.php, 5 ApiQueryDeletedrevs.php, 6 ApiTokens.php, and 7 ApiUnblock.php in includes/api/ in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allow remote attackers to obtain CSRF tokens and bypass the...
CVE-2013-4302
1 ApiBlock.php, 2 ApiCreateAccount.php, 3 ApiLogin.php, 4 ApiMain.php, 5 ApiQueryDeletedrevs.php, 6 ApiTokens.php, and 7 ApiUnblock.php in includes/api/ in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allow remote attackers to obtain CSRF tokens and bypass the...
PT-2019-6942
Name of the Vulnerable Software and Affected Versions MediaWiki versions 1.19.x through 1.19.7 MediaWiki versions 1.20.x through 1.20.6 MediaWiki versions 1.21.x through 1.21.1 Description The issue allows remote attackers to conduct cross-site scripting XSS attacks. This is achieved via the sipr...
PT-2013-4947
Name of the Vulnerable Software and Affected Versions MediaWiki versions 1.19.x through 1.19.7 MediaWiki versions 1.20.x through 1.20.6 MediaWiki versions 1.21.x through 1.21.1 Description The issue allows remote attackers to obtain CSRF tokens and bypass the cross-site request forgery protection...
ecshop2.73 api.php 两处鸡肋注入
简要描述： null 详细说明： switch $POST'act' case 'searchgoodslist': searchgoodslist; break; case 'searchproductslist': searchproductslist; break; ...... function searchproductslist checkauth; ...... if !empty$POST'goodsid' && isnumeric$POST'goodsid' || !empty$POST'bn' //goodsid不为数字,bn不为空.假假得假,假真得真. $sql =...
Discuz! X2.5 api.php 路径泄露
No description provided by source...
PHPCMS V9.17 api/add_favorite.php SQL注入漏洞
$title = urldecode$title; $data = array'title'=$title, 'url'=$url, 'adddate'=SYSTIME, 'userid'=$userid; $favoritedb-insert$data; api.php需要注册用户才能访问，因此利用需要注册用户，并且登录，然后可以直接提交： /api.php?op=addfavorite&url=J&title=%2527%2520and%2520%2528select 这里是V9，因此，我们构造一下语句先： select count,concatselect select selec...