CVE-2012-6523: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in w-CMS 2.01 allow remote attackers to inject arbitrary web script or HTML via 1 the p parameter in the getMenus function in codes/wcms.php; or the COMMENT parameter in 2 blog.php, 3 guestbook.php, or 4 forum.php in codes/. NOTE: some of these...

PT-2013-1986

Name of the Vulnerable Software and Affected Versions w-CMS version 2.01 Description A directory traversal issue exists in the getContent function in codes/wcms.php, allowing remote attackers to read arbitrary files. This is achieved by including a .. dot dot in the p parameter. Recommendations F...