SA-CONTRIB-2011-015 - Translation Management - Multiple Vulnerabilities

This Translation Management module helps to manage the process of translating content on your site. The module has several vulnerabilities. It doesn't sufficiently escape user text when printed to the browser nor when used in database queries resulting in Cross Site Scripting XSS and SQL Injectio...

Symantec IM Manager whereClause Parameter SQL Injection (SYM10-010)

The version of Symantec IM Manager installed on the remote Windows host fails to sanitize input to the 'whereClause' parameter of the 'rdpageimlogic.aspx' script before using it in the 'LoggedInUsers.lgx' definition file to construct database queries. An unauthenticated attacker may be able to...

Huru Helpdesk Component for Joomla! 'cid[0]' Parameter SQLi

The version of the Huru Helpdesk component for Joomla! running on the remote host is affected by a SQL injection vulnerability due to improper sanitization of user-supplied input to the 'cid0' parameter before using it to construct database queries. Regardless of the PHP 'magicquotesgpc' setting,...

RokModule Component for Joomla! 'moduleid' Parameter SQi

The version of the RokModule component for Joomla! running on the remote host is affected by a SQL injection vulnerability due to improper sanitization of user-supplied input to the 'moduleid' parameter before using it to construct database queries. Regardless of the PHP 'magicquotesgpc' setting,...

JS Jobs Component for Joomla! 'md' Parameter SQLi

The version of the JS Jobs component for Joomla! running on the remote host is affected by a SQL injection vulnerability due to improper sanitization of user-supplied input to the 'md' parameter before using it to construct database queries. Regardless of the PHP 'magicquotesgpc' setting, an...

BF Survey Pro Component for Joomla! 'table' Parameter SQLi

The version of BF Survey Pro or BF Survey Pro Free for Joomla! running on the remote host is affected by a SQL injection vulnerability due to improper sanitization of user-supplied input to the 'table' parameter in a POST request when 'task' is set to 'updateOnePage' before using it to construct...

FlexCMS Login Cookie SQL Injection

The remote host is running FlexCMS, a content management system written in PHP. The version of the FlexCMS installed on the remote host fails to sanitize input passed to the login cookie 'FCLoginData12345' before using it in database queries. Provided PHP's 'magicquotesgpc' setting is disabled, a...

Log Rover pword Parameter SQL Injection

The remote host is running Log Rover, an ASP application for analyzing web server log files. The web interface included with the version of Log Rover installed on the remote host fails to sanitize user-supplied input to the 'pword' parameter of the 'login.asp' script before using it to construct...

JVideo! Component for Joomla! 'user_id' Parameter SQLi

The version of the JVideo! component for Joomla! running on the remote host is affected by a SQL injection vulnerability in the models/user.php script due to improper sanitization of user-supplied input to the 'userid' parameter before using it to construct database queries in the getUsername...

Geeklog SEC_authenticate Function SQL Injection

The version of Geeklog installed on the remote host fails to sanitize input to the 'username' argument of the 'SECauthenticate' function in '/system/lib-security.php' before using it to construct database queries. Regardless of PHP's 'magicquotesgpc' setting, an unauthenticated attacker can explo...

SocialEngine Blog Plugin category_id Parameter SQL Injection

The remote host is running SocialEngine, a PHP-based social network platform. The version of the Blog plugin for SocialEngine installed on the remote host fails to sanitize input to the 'categoryid' parameter of the 'blog.php' script before using it to construct database queries. Regardless of...

Meeting Room Booking System (MRBS) month.php area Parameter SQL Injection

The remote host is running Meeting Room Booking System MRBS, a PHP application for booking meeting rooms or other resources. The version of MRBS installed on the remote host fails to sanitize user-supplied input to the 'area' parameter of the 'month.php' script before using it to construct databa...

Eventing Component for Joomla! 'catid' Parameter SQLi

The version of the Eventing component for Joomla! running on the remote host is affected by a SQL injection vulnerability in eventing.php due to improper sanitization of user-supplied input to the 'catid' parameter before using it to construct database queries. Regardless of the PHP...

myEvent 1.6 - 'eventdate' SQL Injection

myEvent 1.6 viewevent.php Remote SQL Injection Vulnerability url: http://mywebland.com/ Author: JosS mail: sys-projectathotmaildotcom site: http://spanish-hackers.com team: Spanish Hackers Team - SHT This was written for educational purpose. Use it at your own risk. Author will be not responsible...

OpenX ac.php bannerid Parameter SQL Injection

The remote host is running OpenX formerly Openads, an open source ad serving application written in PHP. The installed version of OpenX does not validate user-supplied input to the 'bannerid' parameter of the 'www/delivery/ac.php' script before using it in database queries. Regardless of PHP's...

SA-2008-061 - Everyblog - Multiple vulnerabilities

The module does not follow Drupal best practices for database queries and handling of user submitted data, leading to a number of vulnerabilities. Of special concern is that an unprivileged user may become logged in to the account of an existing user, including an administrator. Versions Affected...

Joomla! reset.php Reset Token Validation Forgery

The version of Joomla! running on the remote host is affected by a password reset vulnerability in components/comuser/models/reset.php script due to improper validation of user-supplied input to the 'token' parameter before using it to construct database queries in the confirmReset function. An...

nBill component for Joomla! 'cid' Parameter SQLi

The version of the nBill also known as netinvoice component for Joomla! and Mambo running on the remote host is affected by a SQL injection vulnerability due to improper sanitization of user-supplied input to the 'cid' parameter before using it to construct database queries. Regardless of the PHP...

TrailScout Module For Drupal Session Cookie SQL Injection

The remote host is running TrailScout, a third-party module for Drupal that displays a breadcrumb-like trail showing pages a user recently visited on a site. The version of the TrailScout module installed on the remote host fails to sanitize user-supplied input to the session cookie before using ...

AEC Subscription Manager Component for Mambo / Joomla! 'usage' Parameter SQLi

The version of the AEC Subscription Manager component for Joomla! and Mambo running on the remote host is affected by a SQL injection vulnerability in the acctexp.class.php script due to improper sanitization of user-supplied input to the 'usage' parameter before using it to construct database...