96 matches found
CVE-2012-0987
Directory traversal vulnerability in edituser.php in ImpressCMS 1.2.x before 1.2.7 Final and 1.3.x before 1.3.1 Final allows remote authenticated users to include and execute arbitrary local files via a .. dot dot in the icmsConfigPluginssanitizerplugins parameter...
PT-2012-2992
Name of the Vulnerable Software and Affected Versions ImpressCMS versions 1.2.x through 1.2.6 and versions 1.3.x through 1.3.0 Description The issue allows remote authenticated users to include and execute arbitrary local files. This is achieved by exploiting a directory traversal vulnerability i...
CVE-2012-0987: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in edituser.php in ImpressCMS 1.2.x before 1.2.7 Final and 1.3.x before 1.3.1 Final allows remote authenticated users to include and execute arbitrary local files via a .. dot dot in the icmsConfigPluginssanitizerplugins parameter...
CVE-2012-1992
Cross-site scripting XSS vulnerability in admin/edituser.php in CMS Made Simple 1.10.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the email parameter aka the Email Address field in the Edit User template...
CVE-2012-1992: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in admin/edituser.php in CMS Made Simple 1.10.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the email parameter aka the Email Address field in the Edit User template...
PT-2012-3713
Name of the Vulnerable Software and Affected Versions CMS Made Simple versions 1.10.3 and earlier Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the email parameter in the Edit User template. This is due to a vulnerability in the...
CVE-2009-3757: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in sample code in the XenServer Resource Kit in Citrix XenCenterWeb allow remote attackers to inject arbitrary web script or HTML via the 1 username parameter to config/edituser.php; 2 location, 3 sessionid, and 4 vmname parameters to console.php;...
CVE-2009-2960: Undefined Security Weakness
CuteFlow 2.10.3 and 2.11.0c does not properly restrict access to pages/edituser.php, which allows remote attackers to modify usernames and passwords via a direct request...
Cuteflow 2.10.3 edituser.php Security Bypass Vulnerability
No description provided by source. It's possible edit the users including the admin account, bypassing the authentication through the address: http://localhost/cuteflow/pages/edituser.php?userid=1&language=pt&sortby=st rLastName&sortdir=ASC&start=1 The vulnerability is caused due to the applicati...
Cuteflow 2.10.3 edituser.php Security Bypass Vulnerability
Exploit for unknown platform in category web applications ========================================================== Cuteflow 2.10.3 edituser.php Security Bypass Vulnerability ========================================================== It's possible edit the users including the admin account,...
Cuteflow 2.10.3 - edituser.php Security Bypass
Cuteflow 2.10.3 - edituser.php Security Bypass It's possible edit the users including the admin account, bypassing the authentication through the address: http://localhost/cuteflow/pages/edituser.php?userid=1&language=pt&sortby=st rLastName&sortdir=ASC&start=1 The vulnerability is caused due to t...
Cuteflow 2.10.3 - 'edituser.php' Security Bypass
It's possible edit the users including the admin account, bypassing the authentication through the address: http://localhost/cuteflow/pages/edituser.php?userid=1&language=pt&sortby=st rLastName&sortdir=ASC&start=1 The vulnerability is caused due to the application not properly restricting access ...
CVE-2009-1767
admin/edituser.php in 2daybiz Template Monster Clone does not require administrative authentication, which allows remote attackers to modify arbitrary accounts via the 1 loginname, 2 password, 3 email, 4 firstname, or 5 lastname parameter...
CVE-2009-1767
CVE-2009-1767 involves admin/edituser.php in the 2daybiz Template Monster Clone, where no administrative authentication is required. This permits remote attackers to modify arbitrary accounts via the parameters loginname, password, email, firstname, and lastname. The NVD lists a CVSSv2 base score...
CVE-2009-1767: Undefined Security Weakness
admin/edituser.php in 2daybiz Template Monster Clone does not require administrative authentication, which allows remote attackers to modify arbitrary accounts via the 1 loginname, 2 password, 3 email, 4 firstname, or 5 lastname parameter...
2daybiz Template Monster Clone (edituser.php) Change Pass Exploit
Exploit for unknown platform in category web applications ================================================================= 2daybiz Template Monster Clone edituser.php Change Pass Exploit ================================================================= Template Monster Clone Change Password...
2daybiz Template Monster Clone (edituser.php) Change Pass Exploit
No description provided by source. title Template Monster Clone Change Password /title /head head /head body bgcolor="000000" pfont size="6" color="FF0000"a href="http://www.2daybiz.com/" font color="FF0000"2daybiz/font/a Template Monster Clone /font/p TABLE border=0 width=780 align=center TR...
2DayBiz Template Monster Clone - 'edituser.php' Change Pass
Template Monster Clone Change Password 2daybiz Template Monster Clone Add Categoty Add Templates Edit Templates Show Templates --   Login Namee Password input type =text class=inputstyle...
PowerMovieList 0.14b XSS / SQL Injection
=============================================================================================== Found : brainpillow Dork : "PowerMovieList 0.14 Beta Copyright" Visit : brainpillow.cc, forum.antichat.ru, raz0r.name Mail : [email protected]...
CVE-2008-1632
Multiple SQL injection vulnerabilities in CuteFlow 2.10.0 allow remote authenticated users to execute arbitrary SQL commands via the 1 listid parameter to pages/editmailingliststep1.php, the 2 userid parameter to pages/edituser.php, the 3 fieldid parameter to pages/editfield.php, and the 4...