CVE-2017-9067

In MODX Revolution before 2.5.7, when PHP 5.3.3 is used, an attacker is able to include and execute arbitrary files on the web server due to insufficient validation of the action parameter to setup/index.php, aka directory traversal...

Zen Cart Cross-Site Scripting Vulnerability (CNVD-2017-08298)

Zen Cart is an open source shopping cart system developed by Zen Cart team. The system is mainly used to establish an online store , can support a variety of payment methods , multi-language options , online shopping mall batch update and so on. A cross-site scripting vulnerability exists in the...

CVE-2017-8833

Zen Cart 1.6.0 has XSS in the mainpage parameter to index.php. NOTE: 1.6.0 is not an official release but the vendor's README.md file offers a link to v160.zip with a description of "Download latest in-development version from github."...

CVE-2017-6562

XSS in Agora-Project 3.2.2 exists with an index.php?ctrl=file&targetObjId=fileFolder-2&targetObjIdChild=XSS attack...

Country on Sale Script - SQL Injection

Exploit Title: Country on Sale Script - SQL Injection Google Dork: N/A Date: 09.03.2017 Vendor Homepage: http://www.websitescripts.org/ Software: http://www.websitescripts.org/website-scripts/country-on-sale-script/prod53.html Demo: http://www.websitescripts.org/demo/countryonsalescript/ Version:...

Joomla! Abstract component SQL injection vulnerability

Joomla! is an open source content management system CMS, the system provides RSS feeds, site search and other functions. A SQL injection vulnerability exists in version 2.1 of the Joomla! Abstract component, which is caused by a failure to properly validate the pid parameter on the 'index.php'...

PHPCMS '/phpcms/modules/member/index.php' file upload vulnerability

PHPCMS is a website management software. The software adopts modular development and supports a variety of classification methods, using it can easily realize the design, development and maintenance of personalized websites. A file upload vulnerability exists in PHPCMS...

UBUNTU-CVE-2016-10202

Cross-site scripting XSS vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the path info to index.php...

UBUNTU-CVE-2016-10206

Cross-site request forgery CSRF vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack the authentication of users for requests that change passwords and possibly have unspecified other impact as demonstrated by a crafted user action request to index.php...

DEBIAN-CVE-2016-10204

SQL injection vulnerability in Zoneminder 1.30 and earlier allows remote attackers to execute arbitrary SQL commands via the limit parameter in a log query request to index.php...

WordPress plugin wp-sns-share suffers from a reflected cross-site scripting vulnerability

WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A reflective cross-site scripting vulnerability exists in the WordPress plugin wp-sns-share 'index.php' page, which can be exploited by attackers to construct...

MODX Revolution Directory Traversal Vulnerability (CNVD-2016-13240)

MODX Revolution is a PHP-based open source content management system CMS from the U.S. company MODX. The system supports online collaboration, search engine optimization SEO, add-ons and more. A directory traversal vulnerability exists in the /connectors/index.php file in versions of MODX...

Component realtyna SQL Injection Vulnerability in Joomla!

Joomla! is an open source content management system CMS. A SQL injection vulnerability exists in the Joomla! component realtyna, which allows remote attackers to execute arbitrary SQL commands with the help of the pid parameter in the comrpl operation of index.php...

Reinstallation vulnerability in zzcms version 7.2

ZZCMS highlights the investment and supply and demand functions, you can quickly build a product investment website. ZZCMS system v7.1 has a reinstallation vulnerability that allows an attacker to exploit the vulnerability by visiting /install/index.php, submitting: POST request: submit=1&step=4,...

Mobiketa Cross-Site Request Forgery Vulnerability

Mobiketa is a full-featured SMS and language management software. A cross-site request forgery vulnerability exists in index/php in Mobiketa version 1.0, which can be exploited by remote attackers to perform unauthorized operations and gain access to the affected application...

Joomla! PayPlans Extension 'index.php' SQL Injection Vulnerability

Joomla! is an open source content management system. An SQL injection vulnerability exists in Joomla! PayPlans Extension 'index.php'. Because the program fails to adequately filter user-supplied data before it is used in SQL queries, an attacker can exploit the vulnerability to access or modify...

CubeCart Stored Cross-Site Scripting Vulnerability

CubeCart is an open source PHP e-commerce software system. A stored cross-site scripting vulnerability exists in CubeCart. Due to insufficient filtering of user-supplied data via the "firstname" and "lastname" HTTP POST parameters passed to the "/index.php" script input, a remotely-authenticated...

Roundcube Remote Code Execution Vulnerability

Roundcube is open source software. A remote code execution vulnerability exists in Roundcube. Because the "skin" HTTP POST parameter is not sufficiently filtered in the "/index.php" script, a remotely authenticated attacker can use a path traversal sequence e.g. "... /... /" to be loaded from any...

Zeuscart 'index.php' Cross-Site Scripting Vulnerability

ZeusCart is an open source shopping system based on PHP and MySQL designed for small and medium-sized online stores. A cross-site scripting vulnerability exists in Zeuscart 'index.php', which allows remote attackers to exploit the vulnerability and inject malicious script or HTML code to obtain...

Joomla! jNews component 'index.php' SQL Injection Vulnerability

Joomla! is an open source content management system. jNews is one of the email subscription system components. A SQL injection vulnerability exists in the Joomla! jNews component 'index.php', which allows remote attackers to exploit the vulnerability by submitting a specially crafted SQL query...