CVE-2012-1000

CVE-2012-1000: LEPTON 1.1.3 and earlier versions suffer XSS in multiple user input points. The vulnerability arises from inadequate sanitization of user-supplied data in the parameters responsible for messages and profile fields: message (admins/login/forgot/index.php), and display_name / email (...

LEPTON 1.1.3 SQL Injection / XSS / Local File Inclusion

Exploit for php platform in category web applications Vendor: LEPTON Project Vulnerable Versions: 1.1.3 and probably prior Tested Version: 1.1.3 Vendor Notification: 25 January 2012 Vendor Patch: 4 February 2012 Public Disclosure: 15 February 2012 Vulnerability Type: Local File Inclusion, SQL...

Multiple vulnerabilities in LEPTON

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in LEPTON, which can be exploited to perform Local File Inclusion, Cross Site Scripting and SQL Injection attacks. 1 Local File Inclusion in LEPTON: CVE-2012-0998 Input passed via the "language" POST parameter to...