PT-2017-16789

Name of the Vulnerable Software and Affected Versions ionize versions prior to 1.0.9 Description The issue exists due to insufficient filtration of user-supplied data in the path variable passed to the "ionize-master/themes/admin/javascript/tinymce/jscripts/tiny mce/plugins/codemirror/dialog.php"...

XCart 5.2.6 Cross Site Scripting

Security Advisory - Curesec Research Team 1. Introduction Affected Product: XCart 5.2.6 Fixed in: 5.2.7 Fixed Version Link: https://www.x-cart.com/xc5kit Vendor Contact: [email protected] Vulnerability Type: XSS Remote Exploitable: Yes Reported to vendor: 08/13/2015 Disclosed to public: 11/04/20...

PT-2015-4275

Name of the Vulnerable Software and Affected Versions M2 OptimalSite versions 0.1 through 2.4 Description The issue is related to a cross-site scripting XSS vulnerability. This allows remote attackers to inject arbitrary web script or HTML via the image parameter in the display dialog.php file...

PT-2015-5276

Name of the Vulnerable Software and Affected Versions Gecko CMS versions 2.2 through 2.3 Description The issue allows remote attackers to inject arbitrary web script or HTML via multiple parameters in admin/index.php and js/editor/plugins/filemanager/dialog.php. The vulnerable parameters include...

CVE-2015-1422: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Gecko CMS 2.2 and 2.3 allow remote attackers to inject arbitrary web script or HTML via the 1 horder, 2 jakcatid, 3 jakcontent, 4 jakcss, 5 jakdeletelog, 6 jakemail, 7 jakextfile, 8 jakfile, 9 jakhookshow, 10 jakimg, 11 jakjavascript, 12...

CVE-2014-9582

Cross-site scripting XSS vulnerability in components/filemanager/dialog.php in Codiad 2.4.3 allows remote attackers to inject arbitrary web script or HTML via the shortname parameter in a rename action. NOTE: this issue was originally incorrectly mapped to CVE-2014-1137; see CVE-2014-1137 for mor...

CVE-2014-9582

CVE-2014-9582 affects Codiad 2.4.3 in components/filemanager/dialog.php, where the short_name parameter in a rename action enables cross-site scripting (XSS). This allows remote attackers to inject arbitrary web script or HTML. The issue is explicitly noted as originally mis-mapped to CVE-2014-11...

CVE-2014-9582: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in components/filemanager/dialog.php in Codiad 2.4.3 allows remote attackers to inject arbitrary web script or HTML via the shortname parameter in a rename action. NOTE: this issue was originally incorrectly mapped to CVE-2014-1137; see CVE-2014-1137 for mor...

GroupDocs Document Annotation 1.3.8 - grpdocs-dialog.php Multiple Parameter XSS

The GroupDocs.Annotation for Cloud WordPress plugin was affected by a grpdocs-dialog.php Multiple Parameter XSS security vulnerability...

GroupDocs Viewer 1.4.1 - grpdocs-dialog.php Multiple Parameter XSS

The GroupDocs.Viewer for Cloud WordPress plugin was affected by a grpdocs-dialog.php Multiple Parameter XSS security vulnerability...

WordPress GroupDocs Viewer Plugin <= 1.4.1 - Cross Site Scripting

This plugin is prone to a cross site scripting vulnerability in options.php and grpdocs-dialog.php. Solution Update the plugin...

WordPress GroupDocs Signature Plugin <= 1.2.0 - Cross Site Scripting

This plugin is prone to a cross site scripting vulnerability in grpdocs-dialog.php and options.php. Solution Update the plugin...

WordPress GroupDocs Document Annotation Plugin <= 1.3.8 - XSS

This plugin is prone to a cross site scripting vulnerability in options.php and grpdocs-dialog.php. Solution Update the plugin...

WordPress GroupDocs Viewer Plugin <= 1.4.1 - Cross Site Scripting

This plugin is prone to a cross site scripting vulnerability in options.php and grpdocs-dialog.php. Solution Update the plugin...

PT-2014-5945

Name of the Vulnerable Software and Affected Versions AnyFont plugin versions 2.2.3 and earlier Description The issue is related to a cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary web script or HTML via the text parameter in the mce anyfont/dialog.php file...

PT-2014-5967

Name of the Vulnerable Software and Affected Versions Pro Quoter plugin versions 1.0 and earlier for WordPress Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the leftorright ...

CONTENTCustomizer 3.1 Dialog.PHP Information Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/26291/info CONTENTCustomizer is prone to an information-disclosure vulnerability. An attacker can exploit this issue to access sensitive information that may lead to further attacks. CONTENTCustomizer 3.1mp is vulnerable;...

CVE-2014-4515: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in mceanyfont/dialog.php in the AnyFont plugin 2.2.3 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the text parameter...

SPAW Editor 2.0.8.1 - Local File Inclusion

Exploit Title: local file include Date: Author: soorakh kos Software Link: http://sourceforge.net/projects/spaw/files/spaw-php/SPAW%20PHP%20v.2.0.8.1/spaw-php-2081-gpl.zip/download Version: SPAW Editor v.2 Thanks: kose roya , kose soosan , kose amam,kose dokhtar amam ,and all jaghi iranian boys...

Directory traversal

Directory traversal vulnerability in plugins/spaw2/dialogs/dialog.php in BloofoxCMS 0.3.4 allows remote attackers to read arbitrary files via the 1 lang, 2 theme, and 3 module parameters...