CVE-2015-2564: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in client-edit.php in ProjectSend formerly cFTP r561 allows remote authenticated users to execute arbitrary SQL commands via the id parameter to users-edit.php...

WordPress mTouch Quiz Plugin <= 3.0.6 - SQL Injection

Because of this vulnerability in question.php, the attackers can execute arbitrary SQL commands via the "quiz" parameter to wp-admin/edit.php. Solution Update the plugin...

CVE-2014-9523: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the Our Team Showcase our-team-enhanced plugin before 1.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 change plugin settings via unspecified vectors or 2 conduct cross-site...

CVE-2010-5319: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in Kandidat CMS 1.4.2 allow remote attackers to hijack the authentication of administrators for requests that 1 modify settings via a validate action to admin/settings.php, 2 modify pages via the what parameter to admin/edit.php, or 3 modif...

CVE-2014-7833

CVE-2014-7833 affects Moodle releases up to 2.7.3, where mod/data/edit.php changes set a group ID to zero after a database-entry change. This behavior can allow remote authenticated users to disclose sensitive information by viewing the database after a teacher edits data. The root cause is descr...

CVE-2014-7833: Exposure of Sensitive Information to an Unauthorized Actor

mod/data/edit.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 sets a certain group ID to zero upon a database-entry change, which allows remote authenticated users to obtain sensitive information by accessing the database after an edit by a teacher...

CVE-2014-5185: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the Quartz plugin 1.01.1 for WordPress allows remote authenticated users with Contributor privileges to execute arbitrary SQL commands via the quote parameter in an edit action in the quartz/quoteform.php page to wp-admin/edit.php...

CVE-2014-3546

Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 does not enforce certain capability requirements in 1 notes/index.php and 2 user/edit.php, which allows remote attackers to obtain potentially sensitive username and course information via a...

CVE-2014-3546: Undefined Security Weakness

Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 does not enforce certain capability requirements in 1 notes/index.php and 2 user/edit.php, which allows remote attackers to obtain potentially sensitive username and course information via a...

CVE-2014-4600

Multiple cross-site scripting XSS vulnerabilities in contact/edit.php in the WP Ultimate Email Marketer plugin 1.1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 listname or 2 contact parameter...

CVE-2014-4600: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in contact/edit.php in the WP Ultimate Email Marketer plugin 1.1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 listname or 2 contact parameter...

php-addressbook 3.1.5 - (edit.php) SQL Injection Vulnerability

No description provided by source. @ php-addressbook v3.1.5edit.php SQL Injection Vulnerability @ Author: Hussin X @ Home : www.iq-ty.comhttp://www.iq-ty.com, @ email: darkangelg85atYahoodotcom @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ script :...

Toko Lite CMS 1.5.2 (edit.php) HTTP Response Splitting Vulnerability

No description provided by source. Toko Lite CMS 1.5.2 edit.php HTTP Response Splitting Vulnerability Vendor: Toko Product web page: http://toko-contenteditor.pageil.net Affected version: 1.5.2 Summary: Toko Web Content Editor cms is a compact, multi language, open source web editor and content...

WordPress <= 2.2.3 wp-admin/edit.php backup Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/27123/info WordPress is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the brows...

SlimCMS <= 1.0.0 (edit.php) Remote SQL Injection Exploit

No description provided by source. !/usr/bin/perl =starting -------------------------------------------------------- SlimCMS = 1.0.0 edit.php Remote SQL Injection Exploit -------------------------------------------------------- by athos - stakerathotmaildotit download on sourceforge File edit.php...

Online Contact Manager 3.0 edit.php id Parameter XSS

No description provided by source...

WordPress 1.2 edit.php s Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/11268/info It is reported that Wordpress is affected by various cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input. Wordpress 1.2 is...

Link Bid Script 1.5 - Multiple Remote SQL Injection Vulnerabilities

No description provided by source. + Link Bid Script 1.5 Multiple Remote SQL Injection + Discovered By SirGod + wWw.MorTal-TeaM.OrG + Greetz : E.M.I.N.E.M,Ras,Puscasmarin,ToxicBlood,HrN,kemrayz,007m,Raven,Nytr0gen,str0ke + Remote SQL Injection - Note : For PoC 2 you need administrative rights. Po...

Saurus CMS 4.7.1 - Multiple Vulnerabilities

No description provided by source. waraxe-2013-SA106 - Multiple Vulnerabilities in Saurus CMS 4.7.1 ================================================================================ Author: Janek Vind waraxe Date: 14. July 2013 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-106.html...

Sql injection

Multiple SQL injection vulnerabilities in Gnew 2013.1 allow remote attackers to execute arbitrary SQL commands via the 1 newsid parameter to news/send.php, 2 threadid parameter to posts/edit.php, or 3 useremail parameter to users/password.php or 4 users/register.php. NOTE: these issues were SPLIT...