CVE-2015-6807

CVE-2015-6807 affects the Drupal Mass Contact contributed module (versions 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.1). The vulnerability is a cross-site scripting (XSS) flaw that allows remote authenticated users who have the "administer mass contact" permission to inject arbitrary script...

Zainu 1.0 'searchSongKeyword' Parameter Cross Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/36701/info Zainu is prone to a cross-site scripting vulnerability in the Contact module because the application fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary...

Rash CMS SQL Injection Vulnerability

No description provided by source. ========================================== Rash CMS SQL Injection Vulnerability ========================================== InformatioN Title : Rash CMS SQL Injection Vulnerability Author : keracker Vendor or Software Link : http://rashcms.com Email :...

Chupix CMS Contact Module 0.1 'index.php' Multiple Local File Include Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/30564/info The Contact module for Chupix CMS is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can exploit these issues using directory-traversa...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the contact module admin/modules/contact.php in Pixie CMS 1.04 allow remote attackers to inject arbitrary web script or HTML via the 1 uemail or 2 subject parameter in the Contact form to contact/...

CVE-2014-3786

Multiple cross-site scripting XSS vulnerabilities in the contact module admin/modules/contact.php in Pixie CMS 1.04 allow remote attackers to inject arbitrary web script or HTML via the 1 uemail or 2 subject parameter in the Contact form to contact/...

CVE-2014-3786

Pixie CMS 1.04’s contact module (admin/modules/contact.php) is affected by multiple POST XSS vulnerabilities via the uemail and subject fields in the contact form. A remote attacker could inject arbitrary web script/HTML, enabling script execution in the victim’s browser on the affected site. The...

SA-CONTRIB-2012-141 - Mass Contact - Access bypass

This module allows anyone with permission to send a single message to multiple users of a site, using its roles functionality. The module doesn't sufficiently check permissions after the form has been submitted. This vulnerability is mitigated by the fact that an attacker must use a tool of some...

Cross site scripting

Cross-site scripting XSS vulnerability in the Contact Save module 6.x-1.x before 6.x-1.5 for Drupal allows remote authenticated users with the access site-wide contact form permission to inject arbitrary web script or HTML via unspecified vectors...

Yahoo! Mail Cross Site Request Forgery

======================================================================= YAHOOMAIL CSRF Vulnerability ======================================================================= Vulnerability found in- Yahoomail Delete Contact module email [email protected] company AKS IT Services Pvt. Ltd...

MKPortal Contact module XSS Vulnerability

========================================= MKPortal Contact module XSS Vulnerability ========================================= 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' /' / /' 0 0 /, // ,/ / 1 1 // /' / // /' / /' 0 0 / / / / / / 1 1 / / 0 0 ////// // // //...

MKPortal Contact module XSS Vulnerability

========================================= MKPortal Contact module XSS Vulnerability ========================================= The largest Exploit Database in the world ! 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' /' / /' 0 0 /, // ,/ / 1 1 // /' / // /' / /'...

Cross site scripting

Cross-site scripting XSS vulnerability in the Contact module in Exponent CMS 0.97-GA20090213 allows remote attackers to inject arbitrary web script or HTML via the email parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2009-4744

Cross-site scripting XSS vulnerability in the Contact module in Exponent CMS 0.97-GA20090213 allows remote attackers to inject arbitrary web script or HTML via the email parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Croogo CMS 1.2 Cross Site Scripting Vulnerabilities

Croogo CMS 1.2 Cross Site Scripting Vulnerabilities ========================================== Vulnerable Software: 1.2 and prior Release Date: 2010-03-06 Last Update: 2010-02-01 Critical: Low Impact: Session hijack Denial of service Code execution Solution Status: Webvuln has informed and...

FreeBSD : drupal -- multiple XSS (751823d4-f189-11de-9344-00248c9b4be7)

Drupal Team reports : The Contact module does not correctly handle certain user input when displaying category information. Users privileged to create contact categories can insert arbitrary HTML and script code into the contact module administration page. Such a cross-site scripting attack may...

CVE-2009-4369

Cross-site scripting XSS vulnerability in the Contact module modules/contact/contact.admin.inc or modules/contact/contact.module in Drupal Core 5.x before 5.21 and 6.x before 6.15 allows remote authenticated users with "administer site-wide contact form" permissions to inject arbitrary web script...

Cross site scripting

Cross-site scripting XSS vulnerability in the Contact module modules/contact/contact.admin.inc or modules/contact/contact.module in Drupal Core 5.x before 5.21 and 6.x before 6.15 allows remote authenticated users with "administer site-wide contact form" permissions to inject arbitrary web script...

CVE-2009-4369

Cross-site scripting XSS vulnerability in the Contact module modules/contact/contact.admin.inc or modules/contact/contact.module in Drupal Core 5.x before 5.21 and 6.x before 6.15 allows remote authenticated users with "administer site-wide contact form" permissions to inject arbitrary web script...

CVE-2009-4369

Cross-site scripting XSS vulnerability in the Contact module modules/contact/contact.admin.inc or modules/contact/contact.module in Drupal Core 5.x before 5.21 and 6.x before 6.15 allows remote authenticated users with "administer site-wide contact form" permissions to inject arbitrary web script...