CVE-2009-4369

CVE-2009-4369 describes a Cross-site scripting (XSS) vulnerability in Drupal Core’s Contact module (modules/contact/contact.admin.inc or modules/contact/contact.module). Affects Drupal Core 5.x before 5.21 and 6.x before 6.15. The issue allows remote authenticated users with the permission to “ad...

Drupal 5.x / 6.x Core XSS

The text of this advisory is also available at http://www.madirish.net/?article=441 Description of Vulnerability: - - ----------------------------- Drupal http://drupal.org is a robust content management system CMS written in PHP and MySQL that provides extensibility through various third party...

SA-CORE-2009-009 - Drupal Core - Cross site scripting

Multiple vulnerabilities were discovered in Drupal. Contact category name cross-site scripting The Contact module does not correctly handle certain user input when displaying category information. Users privileged to create contact categories can insert arbitrary HTML and script code into the...

drupal -- multiple cross-site scripting

Drupal Team reports: The Contact module does not correctly handle certain user input when displaying category information. Users privileged to create contact categories can insert arbitrary HTML and script code into the contact module administration page. Such a cross-site scripting attack may le...

Zainu 1.0 - searchSongKeyword Cross-Site Scripting

Zainu 1.0 - searchSongKeyword Cross-Site Scripting source: https://www.securityfocus.com/bid/36701/info Zainu is prone to a cross-site scripting vulnerability in the Contact module because the application fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to...

Zainu 1.0 - 'searchSongKeyword' Cross-Site Scripting

source: https://www.securityfocus.com/bid/36701/info Zainu is prone to a cross-site scripting vulnerability in the Contact module because the application fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an...

CVE-2009-2376

Cross-site scripting XSS vulnerability in the Html::textarea function in application/libraries/Html.php in TangoCMS 2.x before 2.3.0 allows remote attackers to inject arbitrary web script or HTML via the value parameter, related to the Contact module...

Cross site scripting

Cross-site scripting XSS vulnerability in the Html::textarea function in application/libraries/Html.php in TangoCMS 2.x before 2.3.0 allows remote attackers to inject arbitrary web script or HTML via the value parameter, related to the Contact module...

CVE-2009-2376

CVE-2009-2376 affects TangoCMS 2.x prior to 2.3.0, where the Html::textarea function in application/libraries/Html.php is vulnerable to cross-site scripting via the value parameter (related to the Contact module). The issue can allow remote attackers to inject arbitrary web script or HTML. The NV...

CVE-2009-2376

Cross-site scripting XSS vulnerability in the Html::textarea function in application/libraries/Html.php in TangoCMS 2.x before 2.3.0 allows remote attackers to inject arbitrary web script or HTML via the value parameter, related to the Contact module...

Directory traversal

Directory traversal vulnerability in index.php in the Contact module in Chupix CMS 0.1.0, when magicquotesgpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the mods parameter. NOTE: the provenance of this information is unknown; the details...

CVE-2008-3562

CVE-2008-3562 describes a directory traversal vulnerability in the Contact module of Chupix CMS 0.1.0 . When magic_quotes_gpc is disabled, remote attackers can cause arbitrary local file inclusion/execution by using a ".." path traversal via the mods parameter in index.php. The vulnerability’s im...

CVE-2008-3562

Directory traversal vulnerability in index.php in the Contact module in Chupix CMS 0.1.0, when magicquotesgpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the mods parameter. NOTE: the provenance of this information is unknown; the details...

Chupix CMS Contact Module 0.1 - index.php Multiple Local File Inclusions

Chupix CMS Contact Module 0.1 - index.php Multiple Local File Inclusions source: https://www.securityfocus.com/bid/30564/info The Contact module for Chupix CMS is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can exploi...

Chupix CMS Contact Module 0.1 - 'index.php' Multiple Local File Inclusions

source: https://www.securityfocus.com/bid/30564/info The Contact module for Chupix CMS is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can exploit these issues using directory-traversal strings to view local files with...

Design/Logic Flaw

WordPlugin in the wordintegration component in vtiger CRM before 5.0.3 allows remote authenticated users to bypass field level security permissions and merge arbitrary fields in an Email template, as demonstrated by the fields in the Contact module...

CVE-2007-3600

WordPlugin in the wordintegration component in vtiger CRM before 5.0.3 allows remote authenticated users to bypass field level security permissions and merge arbitrary fields in an Email template, as demonstrated by the fields in the Contact module...

Mambo Site Server 4.0.14 - 'banners.php?bid' SQL Injection

source: https://www.securityfocus.com/bid/8647/info It has been reported that Mambo Open Source Server is prone to multiple input validation vulnerabilities that may allow remote attackers to inject malicious SQL syntax into database queries and send anonymous e-mail to arbitrary users. The...