124 matches found
Vtiger CRM 5.4.0, 6.0 RC, 6.0.0 GA (browse.php, file param) - Local File Inclusion
... Vtiger CRM是美国Vtiger公司的一套基于SugarCRM开发的客户关系管理系统（CRM）。该管理系统提供管理、收集、分析客户信息等功能。 ... Vtiger CRM 6.0.0 Security patch 1之前版本的kcfinder/browse.php脚本中存在目录遍历漏洞。远程攻击者可通过download操作中的‘file’参数中的目录遍历字符‘..’利用该漏洞读取任意文件。 POST /vtigercrm6rc2/kcfinder/browse.php?type=files&lng=en&act=download HTTP/1.1 Host:...
Cross site scripting
Cross-site scripting XSS vulnerability in browse.php in SQL Buddy 1.3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the table parameter...
CVE-2014-4304
Cross-site scripting XSS vulnerability in browse.php in SQL Buddy 1.3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the table parameter...
CVE-2014-4304: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in browse.php in SQL Buddy 1.3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the table parameter...
KCFinder 'browse.php'任意文件上传漏洞
Bugtraq ID:66443 KCFinder是CKEditor的一个开源文件管理器插件。 KCFinder 'browse.php'脚本不正确过滤用户提交的上传文件，允许攻击者利用漏洞上传恶意文件并执行。 0 KCFinder 2.51 - 2.53 目前没有详细解决方案提供： http://kcfinder.sunhater.com/...
PunBB <= 1.3.6 'browse.php' Cross-Site Scripting Vulnerability
PunBB 1.3.6 'browse.php' Cross-Site Scripting Vulnerability. Webapps exploit for php platform source: http://www.securityfocus.com/bid/49776/info PunBB is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue t...
YEKTAWEB CMS XSS Vulnerability
================= IUT-CERT ================= Title: YEKTAWEB CMS XSS Vulnerability Vendor: www.yektaweb.com Dork: Powered by Academic Web Tools AWT - Yektaweb Collection Type: Input.Validation.Vulnerability cross-Site scripting Fix: N/A ================== nsec.ir ================= Description:...
Yektaweb CMS Cross Site Scripting
================= IUT-CERT ================= Title: YEKTAWEB CMS XSS Vulnerability Vendor: www.yektaweb.com Dork: Powered by Academic Web Tools AWT - Yektaweb Collection Type: Input.Validation.Vulnerability cross-Site scripting Fix: N/A ================== nsec.ir ================= Description:...
CVE-2009-4985
SQL injection vulnerability in browse.php in Accessories Me PHP Affiliate Script 1.4 allows remote attackers to execute arbitrary SQL commands via the Go parameter...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in Accessories Me PHP Affiliate Script 1.4 allow remote attackers to inject arbitrary web script or HTML via the 1 Keywords parameter to search.php and 2 SearchIndex parameter to browse.php...
CVE-2009-4985
SQL injection vulnerability in browse.php in Accessories Me PHP Affiliate Script 1.4 allows remote attackers to execute arbitrary SQL commands via the Go parameter...
CVE-2009-4985
CVE-2009-4985 describes an SQL injection in browse.php of Accessories Me PHP Affiliate Script 1.4, allowing remote attackers to execute arbitrary SQL via the Go parameter. Affected component is the browser page handling the Go input in the script. The underlying cause is improper input handling l...
CVE-2009-4984: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in Accessories Me PHP Affiliate Script 1.4 allow remote attackers to inject arbitrary web script or HTML via the 1 Keywords parameter to search.php and 2 SearchIndex parameter to browse.php...
CVE-2009-4985: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in browse.php in Accessories Me PHP Affiliate Script 1.4 allows remote attackers to execute arbitrary SQL commands via the Go parameter...
CVE-2009-4797
SQL injection vulnerability in browse.php in JobHut 1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the pk parameter...
Sql injection
SQL injection vulnerability in browse.php in JobHut 1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the pk parameter...
CVE-2009-4797
CVE-2009-4797 describes an SQL injection in JobHut browse.php for versions 1.2 and earlier, exploitable via the pk parameter. The vulnerability allows remote attackers to execute arbitrary SQL commands and may impact data confidentiality, integrity, and availability as described in the CVSS 2.0 v...
CVE-2009-4797: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in browse.php in JobHut 1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the pk parameter...