JVN#48120704: Movable Type plugin A-Form vulnerable to cross-site scripting

Movable Type plugin A-Form provided by ARK-Web co., ltd. contains a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the web browser of the user who accessed the site using the product. Solution Update the Software Update A-Form to the latest version...

ARK-Web A-Member and A-Member for MT cloud SQL Injection Vulnerabilities

ARK-Web A-Member is a membership site builder plugin for Movable Type from ARK-Web Japan.A-Member for MT cloud is its MT cloud based version. A SQL injection vulnerability exists in ARK-Web A-Member and A-Member for MT cloud 3.8.6 and earlier versions. A remote attacker can exploit this...

JVN#78501037: Movable Type plugin A-Member and A-Reserve vulnerable to SQL injection

A-Member and A-Reserve provided by ARK-Web co., ltd. are plugins for Movable Type which provide functions to build a membership website or a reservation website. A-Member and A-Reserve contain SQL injection CWE-89 vulnerability due to the issue in processing cookie values. Impact An attacker who...