90 matches found
CVE-2009-3757: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in sample code in the XenServer Resource Kit in Citrix XenCenterWeb allow remote attackers to inject arbitrary web script or HTML via the 1 username parameter to config/edituser.php; 2 location, 3 sessionid, and 4 vmname parameters to console.php;...
CVE-2009-2960: Undefined Security Weakness
CuteFlow 2.10.3 and 2.11.0c does not properly restrict access to pages/edituser.php, which allows remote attackers to modify usernames and passwords via a direct request...
Cuteflow 2.10.3 edituser.php Security Bypass Vulnerability
No description provided by source. It's possible edit the users including the admin account, bypassing the authentication through the address: http://localhost/cuteflow/pages/edituser.php?userid=1&language=pt&sortby=st rLastName&sortdir=ASC&start=1 The vulnerability is caused due to the applicati...
Cuteflow 2.10.3 edituser.php Security Bypass Vulnerability
Exploit for unknown platform in category web applications ========================================================== Cuteflow 2.10.3 edituser.php Security Bypass Vulnerability ========================================================== It's possible edit the users including the admin account,...
Cuteflow 2.10.3 - edituser.php Security Bypass
Cuteflow 2.10.3 - edituser.php Security Bypass It's possible edit the users including the admin account, bypassing the authentication through the address: http://localhost/cuteflow/pages/edituser.php?userid=1&language=pt&sortby=st rLastName&sortdir=ASC&start=1 The vulnerability is caused due to t...
Cuteflow 2.10.3 - 'edituser.php' Security Bypass
It's possible edit the users including the admin account, bypassing the authentication through the address: http://localhost/cuteflow/pages/edituser.php?userid=1&language=pt&sortby=st rLastName&sortdir=ASC&start=1 The vulnerability is caused due to the application not properly restricting access ...
CVE-2009-1767
admin/edituser.php in 2daybiz Template Monster Clone does not require administrative authentication, which allows remote attackers to modify arbitrary accounts via the 1 loginname, 2 password, 3 email, 4 firstname, or 5 lastname parameter...
CVE-2009-1767
CVE-2009-1767 involves admin/edituser.php in the 2daybiz Template Monster Clone, where no administrative authentication is required. This permits remote attackers to modify arbitrary accounts via the parameters loginname, password, email, firstname, and lastname. The NVD lists a CVSSv2 base score...
CVE-2009-1767: Undefined Security Weakness
admin/edituser.php in 2daybiz Template Monster Clone does not require administrative authentication, which allows remote attackers to modify arbitrary accounts via the 1 loginname, 2 password, 3 email, 4 firstname, or 5 lastname parameter...
2daybiz Template Monster Clone (edituser.php) Change Pass Exploit
Exploit for unknown platform in category web applications ================================================================= 2daybiz Template Monster Clone edituser.php Change Pass Exploit ================================================================= Template Monster Clone Change Password...
2daybiz Template Monster Clone (edituser.php) Change Pass Exploit
No description provided by source. title Template Monster Clone Change Password /title /head head /head body bgcolor="000000" pfont size="6" color="FF0000"a href="http://www.2daybiz.com/" font color="FF0000"2daybiz/font/a Template Monster Clone /font/p TABLE border=0 width=780 align=center TR...
2DayBiz Template Monster Clone - 'edituser.php' Change Pass
Template Monster Clone Change Password 2daybiz Template Monster Clone Add Categoty Add Templates Edit Templates Show Templates --   Login Namee Password input type =text class=inputstyle...
PowerMovieList 0.14b XSS / SQL Injection
=============================================================================================== Found : brainpillow Dork : "PowerMovieList 0.14 Beta Copyright" Visit : brainpillow.cc, forum.antichat.ru, raz0r.name Mail : [email protected]...
CVE-2008-1632
Multiple SQL injection vulnerabilities in CuteFlow 2.10.0 allow remote authenticated users to execute arbitrary SQL commands via the 1 listid parameter to pages/editmailingliststep1.php, the 2 userid parameter to pages/edituser.php, the 3 fieldid parameter to pages/editfield.php, and the 4...
CVE-2008-1632: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL injection vulnerabilities in CuteFlow 2.10.0 allow remote authenticated users to execute arbitrary SQL commands via the 1 listid parameter to pages/editmailingliststep1.php, the 2 userid parameter to pages/edituser.php, the 3 fieldid parameter to pages/editfield.php, and the 4...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in RunCMS before 1.6.1 allow remote attackers to inject arbitrary web script or HTML via 1 the subject parameter to modules/news/submit.php; 2 the PATHINFO to modules/news/index.php, possibly related to the XoopsPageNav class; or 3 an avatar image...
CVE-2007-6545
Multiple cross-site scripting XSS vulnerabilities in RunCMS before 1.6.1 allow remote attackers to inject arbitrary web script or HTML via 1 the subject parameter to modules/news/submit.php; 2 the PATHINFO to modules/news/index.php, possibly related to the XoopsPageNav class; or 3 an avatar image...
CVE-2007-6545: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in RunCMS before 1.6.1 allow remote attackers to inject arbitrary web script or HTML via 1 the subject parameter to modules/news/submit.php; 2 the PATHINFO to modules/news/index.php, possibly related to the XoopsPageNav class; or 3 an avatar image...
CVE-2007-6545
Multiple cross-site scripting XSS vulnerabilities in RunCMS before 1.6.1 allow remote attackers to inject arbitrary web script or HTML via 1 the subject parameter to modules/news/submit.php; 2 the PATHINFO to modules/news/index.php, possibly related to the XoopsPageNav class; or 3 an avatar image...
CVE-2007-4079: Undefined Security Weakness
Multiple cross-site scripting XSS vulnerabilities in AlstraSoft SMS Text Messaging Enterprise allow remote attackers to inject arbitrary web script or HTML via the 1 domain or 2 q parameter to a admin/membersearch.php, or 3 the userid parameter to b admin/edituser.php...