WordPress Sexy Squeeze Pages Plugin - XSS

Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "ID" parameter to lp/index.php. Solution Update the plugin...

PT-2014-8867

Name of the Vulnerable Software and Affected Versions InstaSqueeze Sexy Squeeze Pages plugin for WordPress affected versions not specified Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the id parameter to "lp/index.php" A...

CVE-2014-9176: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the InstaSqueeze Sexy Squeeze Pages plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter to lp/index.php...

CVE-2014-9004: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in vldPersonals before 2.7.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter in a memberprofile action to index.php...

PT-2014-8783

Name of the Vulnerable Software and Affected Versions vldPersonals versions prior to 2.7.1 Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the id parameter in a "member profile" action to "index.php". Recommendations For versions prior t...

PT-2014-8640

Name of the Vulnerable Software and Affected Versions Allomani Weblinks version 1.0 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the default URI to admin.php, the id parameter to admin.php, or go.php. Recommendations For Allomani...

CVE-2014-8593: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Allomani Weblinks 1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 default URI to admin.php or the 2 id parameter to admin.php or 3 go.php...

Sql injection

Multiple SQL injection vulnerabilities in includes/functions.php in Pro Chat Rooms Text Chat Rooms 8.2.0 allow remote authenticated users to execute arbitrary SQL commands via the 1 password, 2 email, or 3 id parameter...

Sql injection

Multiple SQL injection vulnerabilities in Banana Dance B.2.6 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 return, 2 display, 3 table, or 4 search parameter to functions/suggest.php; 5 the id parameter to functions/widgets.php, 6 the category parameter to...

Cross site scripting

Cross-site scripting XSS vulnerability in the Max Foundry MaxButtons plugin before 1.26.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter in a button action on the maxbuttons-controller page to wp-admin/admin.php, related to the button creation pa...

CVE-2014-7181

Cross-site scripting XSS vulnerability in the Max Foundry MaxButtons plugin before 1.26.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter in a button action on the maxbuttons-controller page to wp-admin/admin.php, related to the button creation pa...

CVE-2014-7181: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Max Foundry MaxButtons plugin before 1.26.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter in a button action on the maxbuttons-controller page to wp-admin/admin.php, related to the button creation pa...

PT-2014-7819

Name of the Vulnerable Software and Affected Versions MaxButtons plugin versions prior to 1.26.1 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the id parameter in a button action on the "maxbuttons-controller" page to...

WordPress MaxButtons Plugin <= 1.26.0 - XSS

Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "id" parameter in a button action on the maxbuttons-controller page to wp-admin/admin.php, related to the button creation page. Solution Update the plugin...

CVE-2012-5700: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Baby Gekko before 1.2.2f allow remote attackers to inject arbitrary web script or HTML via the 1 id parameter to admin/index.php or the 2 username or 3 password parameter in blocks/loginbox/loginbox.template.php to index.php. NOTE: some of thes...

PT-2014-2259

Name of the Vulnerable Software and Affected Versions SpiceWorks version 5.3.75941 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the id parameter to the "api v2.json" API endpoint. Recommendations For SpiceWorks version 5.3.75941,...

CVE-2012-2956: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in SpiceWorks 5.3.75941 allows remote authenticated users to execute arbitrary SQL commands via the id parameter to apiv2.json. NOTE: this entry was SPLIT per ADT2 due to different vulnerability types. CVE-2012-6658 is for the XSS...

CVE-2014-5097

Multiple SQL injection vulnerabilities in Free Reprintables ArticleFR 3.0.4 and earlier allow remote attackers to execute arbitrary SQL commands via the id parameter in a 1 get or 2 set action to rate.php...

Sql injection

Multiple SQL injection vulnerabilities in Free Reprintables ArticleFR 3.0.4 and earlier allow remote attackers to execute arbitrary SQL commands via the id parameter in a 1 get or 2 set action to rate.php...

PT-2014-6275

Name of the Vulnerable Software and Affected Versions Free Reprintables ArticleFR versions 3.0.4 and earlier Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the id parameter in a rate.php endpoint, specifically through a 1 get or 2 set action...