CVE-2015-5075

Cross-site request forgery CSRF vulnerability in X2Engine X2CRM before 5.2 allows remote attackers to hijack the authentication of administrators for requests that create an administrative account via a crafted request to index.php/users/create...

Joomla! googleSearch (CSE) component cross-site scripting vulnerability

Joomla! is an open source content management system. googleSearch component for Joomla! is a custom search engine component for Joomla! A cross-site scripting vulnerability in googleSearch component 3.0.2 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the q paramet...

Twit BBS vulnerable to cross-site scripting

Overview Twit BBS provided by LEMON-S PHP contains a persistent cross-site scripting CWE-79 vulnerability due to the processing of imagetitle parameter in index.php. Shoji Baba reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...

LEMON-S PHP Simple Oekaki BBS Cross-Site Scripting Vulnerability

LEMON-S PHP Simple Oekaki BBS is a PHP-based electronic bulletin board BBS script. A cross-site scripting vulnerability exists in the index.php script in LEMON-S PHP Simple Oekaki BBS versions prior to 1.21. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...

WideImage 'index.php' Cross-Site Scripting Vulnerability

WideImage is an open source for image processing object-oriented PHP library . A cross-site scripting vulnerability exists in WideImage that stems from the program's failure to adequately filter user-submitted input. When a user browses the affected site, their browser will execute arbitrary scri...

File Inclusion Vulnerability in Zblog

Zblog is based on the Asp platform Blog blog weblog program. Zblog has a file inclusion vulnerability. zbinstall/index.php does not escape POST, and an attacker can truncate the .php that follows...

DLGuard 'index.php' Information Disclosure Vulnerability

DLGuard is a secure, automated online sales website software designed for Internet businesses. The software offers multiple payment options, secure download links and pages, customer tracking and reporting, and more. An information disclosure vulnerability exists in DLGuard that originates from t...

DLGuard Cross-Site Scripting Vulnerability

DLGuard is a complete sales and customer management system used to protect and streamline online business. A cross-site scripting vulnerability exists in DLGuard. A remote attacker can leverage the 'page', 'c' or 'redirect' parameters in the index.php script or the main page's 'search' field...

my little forum SQL Injection Vulnerability

my little forum is a forum program. A SQL injection vulnerability exists in my little forum 'index.php', which allows remote attackers to submit specially crafted SQL queries to manipulate or obtain database data...

Multiple SQL Injection Vulnerabilities in EcommerceMajor

ecommerceMajor is a PHP-based content management system CMS for building e-commerce portals developed by software developer Bhaskar. EcommerceMajor has multiple SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands via the productbycat parameter product.php o...

EUVD-2015-1559

Multiple cross-site scripting XSS vulnerabilities in Gecko CMS 2.2 and 2.3 allow remote attackers to inject arbitrary web script or HTML via the 1 horder, 2 jakcatid, 3 jakcontent, 4 jakcss, 5 jakdeletelog, 6 jakemail, 7 jakextfile, 8 jakfile, 9 jakhookshow, 10 jakimg, 11 jakjavascript, 12...

SweetRice CMS Cross-Site Scripting Vulnerability

SweetRice is a simple content management system developed using PHP. A cross-site scripting vulnerability in as/index.php in SweetRice CMS versions prior to 0.6.7.1 allows remote attackers to inject arbitrary web script or HTML via a topheight cookie...

SweetRice CMS Has Multiple SQL Injection Vulnerabilities

SweetRice is a simple content management system developed using PHP. Multiple SQL injection vulnerabilities in index.php in SweetRice CMS versions prior to 0.6.7.1 allow remote attackers to exploit the vulnerabilities to execute arbitrary SQL commands...

VulnCheck KEV: CVE-2013-1904

Absolute path traversal vulnerability in steps/mail/sendmail.inc in Roundcube Webmail before 0.7.3 and 0.8.x before 0.8.6 allows remote attackers to read arbitrary files via a full pathname in the value parameter for the genericmessagefooter setting in a save-perf action to index.php, as...

UBUNTU-CVE-2013-4573

Cross-site scripting XSS vulnerability in the ZeroRatedMobileAccess extension for MediaWiki 1.19.x before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote attackers to inject arbitrary web script or HTML via the "to" parameter to index.php...

MetInfo 5.0 Beta Admin Remote Password Change

Exploit for php platform in category web applications Exploit Title: MetInfo 5.0 Beta Admin Remote Password Change Google Dork:"Powered by MetInfo 5.0 Beta" Exploit Author: Index Php Vendor Homepage:www.metinfo.cn Version: 5.0 Beta Tested on: Windows, PHP 5.2 exploit username password 0day.today...

CVE-2013-5979

Directory traversal vulnerability in Spring Signage Xibo 1.2.x before 1.2.3 and 1.4.x before 1.4.2 allows remote attackers to read arbitrary files via a .. dot dot in the p parameter to index.php...

PT-2013-5900

Name of the Vulnerable Software and Affected Versions Spring Signage Xibo versions 1.2.x through 1.2.2 Spring Signage Xibo versions 1.4.x through 1.4.1 Description The issue allows remote attackers to read arbitrary files. This is achieved by using a .. dot dot in the p parameter to the "index.ph...

VulnCheck KEV: CVE-2012-6498

Unrestricted file upload vulnerability in index.php in Atomymaxsite 2.5 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file, as exploited in the wild in October 2012...

CVE-2011-5143

Multiple cross-site scripting XSS vulnerabilities in Open Business Management OBM 2.3.20 and probably earlier allow remote attackers to inject arbitrary web script or HTML via the 1 tfname, 2 tfdelegation, and 3 tfip parameters to index.php. NOTE: the provenance of this information is unknown; th...