Invision Gallery 2.0.7 Index.PHP IMG Parameter SQL Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/21388/info Invision Gallery is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker t...

Wordpress TimThumb 2.8.13 WebShot - Remote Code Execution Exploit

Exploit for php platform in category web applications | | / | \ | |/ |/ | / | | | | | | | | | | | | | / \ | | | || || | |\ | || | | / | | |/|| ||// \| Wordpress TimThumb 2.8.13 WebShot Remote Code Execution 0-day Affected website : a lot Wordpress Themes, Plugins, 3rd party components...

Multiple WordPress Plugins (TimThumb 2.8.13 / WordThumb 1.07) - 'WebShot' Remote Code Execution

| | / | \ | |/ |/ | / | | | | | | | | | | | | | / \ | | | || || | |\ | || | | / | | |/|| ||// \| Wordpress TimThumb 2.8.13 WebShot Remote Code Execution 0-day Affected website : a lot Wordpress Themes, Plugins, 3rd party components Exploit Author : @u0x Pichaya Morimoto Release dates :...

WordPress Flash Photo Gallery Plugin <= 0.7 - XSS

Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "path" parameter. Solution Update the plugin...

CVE-2012-5056

Multiple cross-site scripting XSS vulnerabilities in ownCloud Server before 4.0.8 allow remote attackers to inject arbitrary web script or HTML via the 1 readyCallback parameter to apps/filesodfviewer/src/webodf/webodf/flashput/PUT.swf, the 2 root parameter to apps/gallery/templates/index.php, or...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in ownCloud Server before 4.0.8 allow remote attackers to inject arbitrary web script or HTML via the 1 readyCallback parameter to apps/filesodfviewer/src/webodf/webodf/flashput/PUT.swf, the 2 root parameter to apps/gallery/templates/index.php, or...

CVE-2014-3833

CVE-2014-3833 affects ownCloud Server: multiple XSS flaws in Gallery and core components, exploitable in versions prior to 5.0.16 and 6.0.x prior to 6.0.3, potentially linked to print_unescaped. The connected advisories/entries confirm affected ranges and provide an official remediation path: upg...

CVE-2014-3923

Multiple cross-site scripting XSS vulnerabilities in the Digital Zoom Studio DZS Video Gallery plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the logoLink parameter to 1 preview.swf, 2 previewskinrouge.swf, 3 previewallchars.swf, or 4 previewskinoverlay.swf...

CVE-2014-3923

The CVE-2014-3923 issue affects the WordPress plugin DZS Video Gallery . It involves Multiple XSS vulnerabilities in the deploy/ previews (preview.swf, preview_skin_rouge.swf, preview_allchars.swf, preview_skin_overlay.swf) where an attacker can inject arbitrary web script or HTML via the logoLin...

WordPress DZS Video Gallery Cross Site Scripting / Content Spoofing

Hello list! There are Content Spoofing and Cross-Site Scripting vulnerabilities in plugin DZS Video Gallery for WordPress. After I announced multiple vulnerabilities in DZS Video Gallery at 08.05.2014 and informed developers, they ignored it, so the second advisory is going directly to full...

WordPress DZS Video Gallery Plugin - Multiple XSS

Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...

WordPress Plugin HDW Player - '/wp-admin/admin.php' SQL Injection

source: https://www.securityfocus.com/bid/69105/info The WordPress HDW Player plugin Video Player & Video Gallery is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. An attacker can exploit this issue to compromi...

WordPress Plugin HDW Player - wp-adminadmin.php SQL Injection

WordPress Plugin HDW Player - wp-adminadmin.php SQL Injection source: https://www.securityfocus.com/bid/69105/info The WordPress HDW Player plugin Video Player & Video Gallery is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it i...

WordPress NextGEN Gallery Plugin 1.9.1 - Arbitrary File Upload

NextGEN Gallery plugin's "photocratiajax" parameter is prone to an arbitrary file upload vulnerability. It allows an attacker to upload arbitrary files to the affected computer. Solution Upgrade the plugin...

WordPress Plugin NextGEN Gallery 1.9.1 - 'photocrati_ajax' Arbitrary File Upload

source: https://www.securityfocus.com/bid/68414/info The NextGEN Gallery plugin for WordPress is prone to a vulnerability that lets attackers upload arbitrary files. An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in an arbitrary code...

WordPress Plugin NextGEN Gallery 1.9.1 - photocrati_ajax Arbitrary File Upload

WordPress Plugin NextGEN Gallery 1.9.1 - photocratiajax Arbitrary File Upload source: https://www.securityfocus.com/bid/68414/info The NextGEN Gallery plugin for WordPress is prone to a vulnerability that lets attackers upload arbitrary files. An attacker may leverage this issue to upload arbitra...

CVE-2013-2087

Multiple cross-site scripting XSS vulnerabilities in Gallery 3 before 3.0.7 allow remote attackers to inject arbitrary web script or HTML via the 1 movie title to modules/gallery/controllers/movies.php or 2 key variable to modules/gallery/views/erroradmin.html.php...

CVE-2013-2087

Multiple cross-site scripting XSS vulnerabilities in Gallery 3 before 3.0.7 allow remote attackers to inject arbitrary web script or HTML via the 1 movie title to modules/gallery/controllers/movies.php or 2 key variable to modules/gallery/views/erroradmin.html.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Gallery 3 before 3.0.7 allow remote attackers to inject arbitrary web script or HTML via the 1 movie title to modules/gallery/controllers/movies.php or 2 key variable to modules/gallery/views/erroradmin.html.php...

CVE-2013-2087

CVE-2013-2087 vulnerabilities affect Gallery 3 up to version 3.0.6 (before 3.0.7). The issue arises from two XSS vectors: (1) the movie title passed to modules/gallery/controllers/movies.php and (2) the key variable used in modules/gallery/views/error_admin.html.php. Successful exploitation allow...