CVE-2012-6519

SQL injection vulnerability in modules/poll/index.php in DIY-CMS 1.0 allows remote attackers to execute arbitrary SQL commands via the start parameter to mod.php...

Sflog! CMS 1.0 Arbitrary File Upload

Exploit for php platform in category web applications This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/...

V-CMS 1.0 File Upload

File upload vulnerability in V-CMS inlineimageupload.php Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...

Gazelle CMS 1.0 - Update Statement SQL Injection

Exploit Title: Ananta Gazelle CMS - Update Statement Sql injection Google Dork: - Date: 07-02-2012 Author: hackme Software Link: http://sourceforge.net/projects/ananta/files/stable/Gazelle 1.0 stable/AnantaGazelle1.0.zip/ Version: 1.0 stable Tested on: backbox 2.1 CVE : - SORRY FOR MY BAD ENGLISH...

Unrestricted file upload

Unrestricted file upload vulnerability in includes/inlineimageupload.php in AutoSec Tools V-CMS 1.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in temp/...

CVE-2011-4827

CVE-2011-4827 involves multiple cross-site scripting (XSS) vulnerabilities in AutoSec Tools V-CMS 1.0. The issues occur in a) redirect.php via the p parameter and b) includes/TrueColorPicker/index.php via the box parameter, caused by improper handling in includes/TrueColorPicker/class.TrueColorPi...

CVE-2011-4828

CVE-2011-4828 affects AutoSec Tools V-CMS 1.0, specifically the inline_image_upload.php file upload feature. An unrestricted file upload allows remote attackers to execute arbitrary code by uploading a file with an executable extension and then accessing it via a direct request to the file in tem...

CVE-2011-4826

CVE-2011-4826 affects AutoSec Tools V-CMS 1.0. The vulnerability is an SQL injection in session.php exploitable via the user parameter to process.php, enabling remote attackers to execute arbitrary SQL commands. Multiple connected sources corroborate this flaw (including Red Hat, NVD, and OpenVAS...

V-CMS 1.0 Shell Upload

------------------------------------------------------------------------ Software................V-CMS 1.0 Vulnerability...........Arbitrary Upload Threat Level............Very Critical 5/5 Download................http://v-cms.org/ Discovery Date..........11/13/2011 Tested On...............Window...

V-CMS 1.0 Cross Site Scripting

------------------------------------------------------------------------ Software................V-CMS 1.0 Vulnerability...........Reflected Cross-site Scripting Threat Level............Low 1/5 Download................http://v-cms.org/ Discovery Date..........11/13/2011 Tested...

Webistry CMS 1.0 SQL Injection

Exploit Title : Webistry v1.0 CMS SQL Injection Vulnerability Author : CoBRa21 E-Mail : uykucu at windowslive.com Google Dork : Powered by CMS : Webistry v1.0 Script Page : null Exploit http://127.0.0.1/ PATH /index.php?pid=14' SQL http://127.0.0.1/ PATH /index.php?pid=14 union select...

Yet Another CMS 1.0 - SQL Injection / Cross-Site Scripting

Advisory: Yet Another CMS 1.0 SQL Injection & XSS vulnerabilities Advisory ID: SSCHADV2011-031 Author: Stefan Schurtz Affected Software: Successfully tested on Yet Another CMS 1.0 Vendor URL: http://yetanothercms.codeplex.com/ Vendor Status: informed ========================== Vulnerability...

Yet Another CMS 1.0 - SQL Injection Cross-Site Scripting

Yet Another CMS 1.0 - SQL Injection Cross-Site Scripting Advisory: Yet Another CMS 1.0 SQL Injection & XSS vulnerabilities Advisory ID: SSCHADV2011-031 Author: Stefan Schurtz Affected Software: Successfully tested on Yet Another CMS 1.0 Vendor URL: http://yetanothercms.codeplex.com/ Vendor Status...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the comment feature in Skeletonz CMS 1.0, when the Blog plugin is enabled, allow remote attackers to inject arbitrary web script or HTML via the 1 Name, 2 Website, and 3 Email parameters. NOTE: some of these details are obtained from third part...

CVE-2010-4734

CVE-2010-4734 : Concrete details across multiple sources show multiple XSS vulnerabilities in the comment feature of Skeletonz CMS 1.0 when the Blog plugin is enabled. The vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the Name, Website, and Email parameters. Th...

Micro CMS 1.0 - name HTML Injection (2)

Micro CMS 1.0 - name HTML Injection 2 source: https://www.securityfocus.com/bid/44300/info Micro CMS is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content. Successful exploits will allow...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in themes/default/index.php in Free Simple CMS 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the 1 meta or 2 phpincdir parameter, a different issue than CVE-2010-3307...

CVE-2010-3742

CVE-2010-3742 describes multiple PHP remote file inclusion vulnerabilities in Free Simple CMS 1.0, specifically in themes/default/index.php. The underlying issue allows an attacker to cause arbitrary PHP code execution by supplying a URL in the (1) meta or (2) phpincdir parameter, as reported (di...

CVE-2010-3307

CVE-2010-3307 involves multiple PHP remote file inclusion vulnerabilities in the Free Simple CMS 1.0 (and earlier). The issue arises in the themes/default/index.php file, where a URL provided in the following parameters can be used to include remote code: body, footer, header, menu_left, and menu...

CVE-2010-3206

Multiple PHP remote file inclusion vulnerabilities in DiY-CMS 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the 1 lang parameter to modules/guestbook/blocks/control.block.php, 2 mainmodule parameter to index.php, and 3 getFile parameter to includes/general.functions.php...