CVE-2012-1212: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the smwfOnSfSetTargetName function in extensions/SMWHalo/includes/SMWInitialize.php in Semantic Enterprise Wiki SMW+ 1.5.6, 1.6.02 and earlier allows remote attackers to inject arbitrary web script or HTML via the target parameter to...

CVE-2012-1200: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Nova CMS allow remote attackers to execute arbitrary PHP code via a URL in the 1 fileType parameter to optimizer/index.php, 2 id parameter to administrator/modules/moduleslist.php, 3 filename parameter to includes/function/gets.php, or 4...

PT-2012-3017

Name of the Vulnerable Software and Affected Versions D-Mack Media Currency Converter mod currencyconverter module version 1.0.0 for Joomla! Description The issue is related to a cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary web script or HTML via the from...

CVE-2012-1018: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in includes/convert.php in D-Mack Media Currency Converter modcurrencyconverter module 1.0.0 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the from parameter...

ShopNC 1.3 tasteless local includes-vulnerability warning-the black bar safety net

This thing in front there is axss http://www.badguest.cn/Article/201107/98039.html -------------------------------------------------------------------------------- GPC before everything is floating clouds. of. So tasteless. it. ./ control/adv.php class advControl / Display advertising / public...

WORK system 4.0.57 Remote File Includes Vulnerability

Exploit for php platform in category web applications Exploit Title: WORK system 4.0.57 Remote File Includes Vulnerability Google Dork: "Worksystem Version 4.0.57" Date: 22/12/2011 Author: Dr.5RaB Software Link http://sourceforge.net/projects/worksystem/files/latest/download: Version: 4.0.57 Test...

PT-2011-5127

Name of the Vulnerable Software and Affected Versions AutoSec Tools V-CMS version 1.0 Description The issue allows remote attackers to inject arbitrary web script or HTML, which can be achieved via two parameters: the p parameter to "redirect.php" and the box parameter to...

PT-2011-5128

Name of the Vulnerable Software and Affected Versions AutoSec Tools V-CMS version 1.0 Description The issue allows remote attackers to execute arbitrary code by uploading a file with an executable extension to the includes/inline image upload.php script, and then accessing it via a direct request...

CVE-2011-4828: Improper Control of Generation of Code

Unrestricted file upload vulnerability in includes/inlineimageupload.php in AutoSec Tools V-CMS 1.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in temp/...

Uiga Personal Portal Cross Site Scripting / Blind SQL Injection

Exploit Title: Uiga Personal Portal Multiple Vulnerability Date: 2011 Author: Eyup CELIK Version: All Version Tested on: All versions are Vulnerability Web Site: www.eyupcelik.com.tr ISSUE Blind SQL Injection and XSS can be done using the command input Vulnerable Page: index.php cart.php...

Information disclosure

WSN Software 6.0.6 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by includes/prestart.php and certain other files...

CVE-2011-3792

Pixelpost 1.7.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by includes/functionsfeeds.php and certain other files...

PT-2011-4682

Name of the Vulnerable Software and Affected Versions Pixelpost version 1.7.3 Description The issue allows remote attackers to obtain sensitive information via a direct request to a .php file. This is achieved by accessing certain files, such as includes/functions feeds.php, which reveals the...

PT-2011-4699

Name of the Vulnerable Software and Affected Versions TheHostingTool THT version 1.2.3 Description The issue allows remote attackers to obtain sensitive information via a direct request to a .php file. This is demonstrated by files such as includes/pear/Mail/smtp.php, which reveals the installati...

PT-2011-4703

Name of the Vulnerable Software and Affected Versions Virtual War aka VWar version 1.5.0r15 Description The issue allows remote attackers to obtain sensitive information via a direct request to a .php file. This is achieved by accessing specific files, such as includes/language/dutch.inc.php, whi...

PT-2011-4708

Name of the Vulnerable Software and Affected Versions WordPress versions 2.9.2 through 3.0.4 Description The issue allows remote attackers to obtain sensitive information via a direct request to a .php file. This is demonstrated by files such as wp-admin/includes/user.php, which reveals the...

PT-2011-4710

Name of the Vulnerable Software and Affected Versions WSN Software version 6.0.6 Description The issue allows remote attackers to obtain sensitive information via a direct request to a .php file. This is demonstrated by files such as includes/prestart.php, which reveals the installation path in a...

CVE-2011-3818

WordPress 2.9.2 and 3.0.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by wp-admin/includes/user.php and certain other files...

CVE-2011-3792

Pixelpost 1.7.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by includes/functionsfeeds.php and certain other files...

CVE-2011-3824

Your Own URL Shortener YOURLS 1.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by includes/auth.php and certain other files...