Cross site scripting

Cross-site scripting XSS vulnerability in include/tool/editingfiles.php in gpEasy CMS 1.6.2 allows remote authenticated users, with Edit privileges, to inject arbitrary web script or HTML via the gpcontent parameter to index.php. NOTE: some of these details are obtained from third party informati...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in gpEasy CMS 1.6.2, 1.6.1, and earlier allows remote attackers to hijack the authentication of administrators for requests that create new administrative users via an AdminUsers action to index.php. NOTE: some of these details are obtained from third...

CVE-2010-2038

Cross-site scripting XSS vulnerability in include/tool/editingfiles.php in gpEasy CMS 1.6.2 allows remote authenticated users, with Edit privileges, to inject arbitrary web script or HTML via the gpcontent parameter to index.php. NOTE: some of these details are obtained from third party informati...

CVE-2010-2039

gpEasy CMS versions 1.6.2, 1.6.1 and earlier are vulnerable to Cross-site request forgery (CSRF) that lets remote attackers hijack administrator sessions via an Admin_Users action to index.php and create new admin users. Root cause: CSRF in the administrative user-creation flow, enabling unauthor...

CVE-2010-2039

Cross-site request forgery CSRF vulnerability in gpEasy CMS 1.6.2, 1.6.1, and earlier allows remote attackers to hijack the authentication of administrators for requests that create new administrative users via an AdminUsers action to index.php. NOTE: some of these details are obtained from third...

CVE-2010-2038

gpEasy CMS 1.6.2 contains a Cross-site scripting (XSS) vulnerability in include/tool/editing_files.php, exploitable via the gpcontent parameter to index.php. An authenticated user with Edit privileges can inject arbitrary HTML/JavaScript, which executes in the browser of other users. The CVE entr...

XSS vulnerability in gpEasy CMS

Vulnerability ID: HTB22370 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityingpeasycms.html Product: gpEasy CMS Vendor: gpeasy Vulnerable Version: 1.6.2 and Probably Prior Versions Vendor Notification: 05 May 2010 Vulnerability Type: XSS Cross Site Scripting Status: Fixed by Vendor Ris...

gpEasy CMS 1.6.2 Cross Site Scripting

Vulnerability ID: HTB22370 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityingpeasycms.html Product: gpEasy CMS Vendor: gpeasy Vulnerable Version: 1.6.2 and Probably Prior Versions Vendor Notification: 05 May 2010 Vulnerability Type: XSS Cross Site Scripting Status: Fixed by Vendor Ris...

gpEasy CMS 1.6.2 - editing_files.php Cross-Site Scripting

gpEasy CMS 1.6.2 - editingfiles.php Cross-Site Scripting source: https://www.securityfocus.com/bid/40330/info gpEasy CMS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code...

gpEasy CMS 1.6.2 - 'editing_files.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/40330/info gpEasy CMS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of...

Multiple Vulnerabilities in gpEasy CMS

High-Tech Bridge SA Security Research Lab has discovered two vulnerabilities in gpEasy CMS which could be exploited to perform cross-site scripting and cross-sire request forgery attacks. 1 Cross-site scripting vulnerability in gpEasy CMS: CVE-2010-2038 The vulnerability exists due to input...