CVE-2010-4881

Multiple cross-site request forgery CSRF vulnerabilities in calendar.class.php in ApPHP Calendar ApPHP CAL allow remote attackers to hijack the authentication of unspecified victims for requests that use the 1 categoryname, 2 categorydescription, 3 eventname, or 4 eventdescription parameter...

CVE-2010-4880

Multiple cross-site scripting XSS vulnerabilities in calendar.class.php in ApPHP Calendar ApPHP CAL allow remote attackers to inject arbitrary web script or HTML via the 1 categoryname, 2 categorydescription, 3 eventname, or 4 eventdescription parameter...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in calendar.class.php in ApPHP Calendar ApPHP CAL allow remote attackers to inject arbitrary web script or HTML via the 1 categoryname, 2 categorydescription, 3 eventname, or 4 eventdescription parameter...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in calendar.class.php in ApPHP Calendar ApPHP CAL allow remote attackers to hijack the authentication of unspecified victims for requests that use the 1 categoryname, 2 categorydescription, 3 eventname, or 4 eventdescription parameter...

CVE-2010-4881

Affected product : ApPHP Calendar (ApPHP CAL), specifically the calendar.class.php component. Vulnerability : Multiple cross-site request forgery (CSRF) weaknesses that allow remote attackers to hijack an authenticated user’s session for requests using one of four parameters: category_name, categ...

CVE-2010-4880

CVE-2010-4880 : Multiple XSS flaws in calendar.class.php of ApPHP Calendar (ApPHP CAL) allow remote injection of scripts via category_name, category_description, event_name, or event_description parameters. The connected documents confirm the vulnerable component and vectors but do not provide ve...

CVE-2010-4880

Multiple cross-site scripting XSS vulnerabilities in calendar.class.php in ApPHP Calendar ApPHP CAL allow remote attackers to inject arbitrary web script or HTML via the 1 categoryname, 2 categorydescription, 3 eventname, or 4 eventdescription parameter...

CVE-2010-4881

Multiple cross-site request forgery CSRF vulnerabilities in calendar.class.php in ApPHP Calendar ApPHP CAL allow remote attackers to hijack the authentication of unspecified victims for requests that use the 1 categoryname, 2 categorydescription, 3 eventname, or 4 eventdescription parameter...

ApPHP Shopping Cart <= XSRF (Change Admin Password)

Exploit for php platform in category web applications ================================================================================= . . . . | | ||/ | || | / / \ / /\ | | / | \ \ | |/ | \ / | || | // | / // | \ /\ | /|//|||| |\ | / /|| / Exploit-ID is the Indonesian Exploit Archive Web...

XSRF &#40;CSRF&#41; in PHP MicroCMS

Vulnerability ID: HTB22765 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinphpmicrocms.html Product: PHP MicroCMS Vendor: ApPHP http://www.apphp.com/ Vulnerable Version: 1.0.1 and probably prior versions Vendor Notification: 21 December 2010 Vulnerability Type: CSRF Cross-Site Request Forger...

XSS vulnerability in PHP MicroCMS

Vulnerability ID: HTB22764 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinphpmicrocms.html Product: PHP MicroCMS Vendor: ApPHP http://www.apphp.com/ Vulnerable Version: 1.0.1 and probably prior versions Vendor Notification: 21 December 2010 Vulnerability Type: XSS Cross Site Scripti...

PHP MicroCMS 1.0.1 - Cross-Site Request Forgery Cross-Site Scripting

PHP MicroCMS 1.0.1 - Cross-Site Request Forgery Cross-Site Scripting Vulnerability ID: HTB22765 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinphpmicrocms.html Product: PHP MicroCMS Vendor: ApPHP http://www.apphp.com/ Vulnerable Version: 1.0.1 and probably prior versions Vendor Notification...

PHP MicroCMS 1.0.1 Cross Site Request Forgery / Cross Site Scripting

================================== Vulnerability ID: HTB22765 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinphpmicrocms.html Product: PHP MicroCMS Vendor: ApPHP http://www.apphp.com/ Vulnerable Version: 1.0.1 and probably prior versions Vendor Notification: 21 December 2010 Vulnerability...

PHP MicroCMS 1.0.1 - Cross-Site Request Forgery / Cross-Site Scripting

Vulnerability ID: HTB22765 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinphpmicrocms.html Product: PHP MicroCMS Vendor: ApPHP http://www.apphp.com/ Vulnerable Version: 1.0.1 and probably prior versions Vendor Notification: 21 December 2010 Vulnerability Type: CSRF Cross-Site Request Forger...

CVE-2010-3480

Directory traversal vulnerability in index.php in ApPHP PHP MicroCMS 1.0.1, when magicquotesgpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the page parameter...

Directory traversal

Directory traversal vulnerability in index.php in ApPHP PHP MicroCMS 1.0.1, when magicquotesgpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the page parameter...

Sql injection

Multiple SQL injection vulnerabilities in login.php in ApPHP PHP MicroCMS 1.0.1, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 username and 2 password variables, possibly related to include/classes/Login.php. NOTE: some of these details are...

CVE-2010-3480

CVE-2010-3480 affects ApPHP PHP MicroCMS 1.0.1. The vulnerability is a directory traversal/local file include in index.php exploitable via a .. in the page parameter when magic_quotes_gpc is disabled, allowing remote inclusion/execution of arbitrary local files in the webserver context. OpenVAS e...

CVE-2010-3481

CVE-2010-3481 affects ApPHP PHP MicroCMS 1.0.1. It discloses multiple SQL injection vulnerabilities in login.php when magic_quotes_gpc is disabled, allowing remote attackers to potentially execute arbitrary SQL via (1) user_name and (2) password variables, possibly tied to include/classes/Login.p...

CVE-2010-3480

Directory traversal vulnerability in index.php in ApPHP PHP MicroCMS 1.0.1, when magicquotesgpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the page parameter...