Malware exploit: Smoke Loader

Type: SQLi http://localhost/control.php?id=1 http://localhost/guest.php?id=1 POST...

蝉知CMS system/module/message/control.php SQL注入

No description provided by source...

蝉知企业门户 control.php 任意文件读取漏洞

No description provided by source...

nexideahealth.com XSS vulnerability

Vulnerable URL: http://www.nexideahealth.com/control.php?collection=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 26.07.2017 Latest check for patch:| 26.07.2017 15:39 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa...

Zentao 6.x /module/editor/control.php 任意文件创建漏洞

No description provided by source...

CVE-2012-4234: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the group moderation screen in the control center control.php in Phorum before 5.2.19 allows remote attackers to inject arbitrary web script or HTML via the group parameter...

Smoke Loader LFI / File Deletion Vulnerabilities

Smoke Loader Command and Control panel suffers from local file inclusion and file deletion vulnerabilities. Two other vulnerabilities I forgot to mention, lfi and file deletion via control.php. The user must be logged into the administrative panel. 1. LFI GET...

Phorum 'real_name' Parameter Cross-Site Scripting Vulnerability

This host is running Phorum and is prone to cross-site scripting vulnerability. OpenVAS Vulnerability Test $Id: gbphorumxssvuln.nasl 7029 2017-08-31 11:51:40Z teissa $ Phorum 'realname' Parameter Cross-Site Scripting Vulnerability Authors: Madhuri D Copyright: Copyright c 2011 Greenbone Networks...

CVE-2011-3392

Summary: CVE-2011-3392 is a cross-site scripting (XSS) vulnerability in Phorum 5.2.x prior to 5.2.17. The flaw resides in the control.php script within the controlcenter, where the real_name parameter is not properly sanitized, allowing an attacker to inject arbitrary HTML/JavaScript into a user’...

CVE-2011-3392: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in control.php in the controlcenter in Phorum before 5.2.17 allows remote attackers to inject arbitrary web script or HTML via the realname parameter...

CVE-2005-3942

CVE-2005-3942 pertains to Orca Knowledgebase, affected in version 2.1b and earlier. The vulnerability is a SQL injection in the knowledgebase-control.php component, exploited via the qid parameter, allowing remote attackers to execute arbitrary SQL commands. The available documents do not provide...

CVE-2005-3942: Undefined Security Weakness

SQL injection vulnerability in knowledgebase-control.php in Orca Knowledgebase 2.1b and earlier allows remote attackers to execute arbitrary SQL commands via the qid parameter...

CVE-2005-2836

Multiple cross-site scripting XSS vulnerabilities in Phorum 5.0.17a and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the username parameter to register.php or 2 a signature of a logged-in user in "My Control Center," which is not properly handled by control.php...

CVE-2005-2836

CVE-2005-2836 affects Phorum versions up to 5.0.17a. The vuln arises from cross-site scripting in two input points: (1) the username field in register.php and (2) a signed-in user’s signature shown in “My Control Center,” not properly sanitized by control.php. The result is remote injection of sc...

CVE-2005-2836: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Phorum 5.0.17a and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the username parameter to register.php or 2 a signature of a logged-in user in "My Control Center," which is not properly handled by control.php...