SNewsCMS 2.1 - 'News_page.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/25963/info SNewsCMS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content. An attacker may leverage this issue to execute arbitrary script code in the...

IT!CMS 0.2 - lang-en.php?wndtitle Cross-Site Scripting

IT!CMS 0.2 - lang-en.php?wndtitle Cross-Site Scripting source: https://www.securityfocus.com/bid/25129/info IT!CMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content. An attacker may...

IT!CMS 0.2 - menu-ed.php?wndtitle Cross-Site Scripting

IT!CMS 0.2 - menu-ed.php?wndtitle Cross-Site Scripting source: https://www.securityfocus.com/bid/25129/info IT!CMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content. An attacker may...

IT!CMS 0.2 - 'menu-ed.php?wndtitle' Cross-Site Scripting

source: https://www.securityfocus.com/bid/25129/info IT!CMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content. An attacker may leverage these issues to execute arbitrary script code ...

IT!CMS 0.2 - 'titletext-ed.php?wndtitle' Cross-Site Scripting

source: https://www.securityfocus.com/bid/25129/info IT!CMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content. An attacker may leverage these issues to execute arbitrary script code ...

ETicket 1.5.5 - Open.php Multiple Cross-Site Scripting Vulnerabilities

ETicket 1.5.5 - Open.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/24681/info eTicket is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input before using it in dynamically...

[MajorSecurity Advisory #49]Calimero.CMS - Session fixation Issue

MajorSecurity Advisory 49Calimero.CMS - Session fixation Issue Details ======= Product: Calimero.CMS Affected version: 3.3.1232 and prior Remote-Exploit: yes Vendor-URL: http://www.calimero-cms.de Vendor-Status: informed Advisory-Status: published Credits ============ Discovered by: David...

[MajorSecurity Advisory #48]eggblog - Session fixation Issue

MajorSecurity Advisory 48eggblog - Session fixation Issue Details ======= Product: eggblog Affected version: 3.1.0 and prior Remote-Exploit: yes Vendor-URL: http://www.eggblog.net Vendor-Status: informed Advisory-Status: published Credits ============ Discovered by: David Vieira-Kurz...

Ruby on Rails 1.2.3 To_JSON - Script Injection

Ruby on Rails 1.2.3 ToJSON - Script Injection source: https://www.securityfocus.com/bid/24161/info Ruby on Rails is prone to a script-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied...

Ruby on Rails 1.2.3 To_JSON - Script Injection

source: https://www.securityfocus.com/bid/24161/info Ruby on Rails is prone to a script-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied script code would run in the context of the...

ClonusWiki 0.5 - index.php HTML Injection

ClonusWiki 0.5 - index.php HTML Injection source: https://www.securityfocus.com/bid/24101/info ClonusWiki is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and...

vBulletin 3.6.6 - 'calendar.php' HTML Injection

source: https://www.securityfocus.com/bid/24020/info vBulletin is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script code would run in the context of th...

[SECURITY] Fedora Core 6 Update: php-5.1.6-3.6.fc6

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated webpages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

[MajorSecurity Advisory #47]Simple Machines Forum (SMF) - Session fixation Issue

MajorSecurity Advisory 47Simple Machines Forum SMF - Session fixation Issue Details ======= Product: Simple Machines Forum SMF Affected version: 1.1.2 and prior Remote-Exploit: yes Vendor-URL: http://www.simplemachines.org Vendor-Status: informed Advisory-Status: published Credits ============...

[MajorSecurity Advisory #41]onelook courts online - Session fixation Issue

MajorSecurity Advisory 41onelook courts online - Session fixation Issue Details ======= Product: courts online Remote-Exploit: yes Vendor-URL: http://www.onebyone.ch/ Vendor-Status: informed Advisory-Status: published Credits ============ Discovered by: David Vieira-Kurz http://www.majorsecurity....

Fizzle 0.5 - RSS Feed HTML Injection

source: https://www.securityfocus.com/bid/23144/info Fizzle is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script code would run in the context of the...

Nullsoft SHOUTcast 1.9.7 - Logfile HTML Injection

Nullsoft SHOUTcast 1.9.7 - Logfile HTML Injection source: https://www.securityfocus.com/bid/22742/info Nullsoft SHOUTcast is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML...

phpBB 2.0.21 - 'privmsg.php' HTML Injection

source: https://www.securityfocus.com/bid/22001/info phpBB is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script code would execute in the context of th...

eTicket 1.5.5 - newticket.php Multiple Cross-Site Scripting Vulnerabilities

eTicket 1.5.5 - newticket.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/27130/info eTicket is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input before using it in dynamically...

eTicket 1.5.5 - 'newticket.php' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/27130/info eTicket is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. An attacker may leverage these issues to execute arbitrar...