CVE-2012-3872: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Open Constructor 3.12.0 allow remote attackers to inject arbitrary web script or HTML via 1 the result parameter to data/file/edit.php, 2 the q parameter to confirm.php, or 3 the keyword parameter to users/users.php...

PT-2012-5055

Name of the Vulnerable Software and Affected Versions Open Constructor version 3.12.0 Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting XSS attacks. This can be achieved via several parameters, including the result...

PT-2012-5056

Name of the Vulnerable Software and Affected Versions Open Constructor version 3.12.0 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the id parameter to several API endpoints, including "data/gallery/edit.php",...