CVE-2015-5066

Multiple cross-site scripting XSS vulnerabilities in the MetalGenix GeniXCMS 0.0.3 allow remote attackers to inject arbitrary web script or HTML via the 1 content or 2 title field in an add action in the posts page to index.php or the 3 q parameter in the posts page to index.php...

CVE-2015-5066

Multiple cross-site scripting XSS vulnerabilities in the MetalGenix GeniXCMS 0.0.3 allow remote attackers to inject arbitrary web script or HTML via the 1 content or 2 title field in an add action in the posts page to index.php or the 3 q parameter in the posts page to index.php...

PT-2015-6764

Name of the Vulnerable Software and Affected Versions GeniXCMS version 0.0.3 Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting XSS attacks. This can be achieved via the content or title field in an add action in the...

GeniXCMS 0.0.3 - Cross-Site Scripting

GeniXCMS 0.0.3 - Cross-Site Scripting Exploit Title: Persistent XSS Google Dork: intitle: Persistent XSS Date: 2015-06-21 Exploit Author: John Page hyp3rlinx Website: hyp3rlinx.altervista.org Vendor Homepage: genixcms.org Software Link: genixcms.org Version: 0.0.3 Tested on: windows 7 Category:...

ClickHeat Cross-Site Request Forgery Vulnerability

ClickHeat is Labsmedia Cloud Computing Center developed a set of open source website heat map generation tool . The tool can count the heat distribution map of user clicks on a page , and support for Chinese display . ClickHeat 1.14 and previous versions of cross-site request forgery vulnerabilit...

CVE-2015-4713

Affected software: ApPHP Hotel Site 3.x.x. Vulnerability: SQL injection via the pid parameter to index.php, enabling arbitrary SQL commands to be executed by remote attackers. Root cause (as stated): Insufficient input filtering/validation of the pid parameter, permitting crafted input to alter S...

CVE-2015-4713: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in ApPHP Hotel Site 3.x.x allows remote editors to execute arbitrary SQL commands via the pid parameter to index.php...

PT-2015-6675

Name of the Vulnerable Software and Affected Versions ApPHP Hotel Site versions 3.x.x Description The issue allows remote editors to execute arbitrary SQL commands. This is achieved via the pid parameter to the "index.php" endpoint. Recommendations For ApPHP Hotel Site versions 3.x.x, avoid using...

PT-2015-6659

Name of the Vulnerable Software and Affected Versions ClickHeat versions 1.14 and earlier Description A cross-site request forgery issue allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via a config action to "index.php"...

CVE-2015-4659: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in ClickHeat 1.14 and earlier allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via a config action to index.php...

PT-2015-6656

Name of the Vulnerable Software and Affected Versions Synology Photo Station versions prior to 6.3-2945 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the success parameter to "login.php" or crafted URL parameters to "index.php", suc...

CVE-2015-4656: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Synology Photo Station before 6.3-2945 allow remote attackers to inject arbitrary web script or HTML via the 1 success parameter to login.php or 2 crafted URL parameters to index.php, as demonstrated by the t parameter to photo/...

PT-2015-5899

Name of the Vulnerable Software and Affected Versions Akronymmanager sb akronymmanager extension versions prior to 7.0.0 for TYPO3 Description The issue allows remote authenticated users with permission to maintain acronyms to execute arbitrary SQL commands. This is achieved via the id parameter ...

Projectsend r572 Cross Site Scripting

Title: Projectsend r572 - Cross Site Scripting Reflected Disclosed: 5/28/15 Vendor Patched: 6/6/15 Published: 6/10/15 Credit: Matt Landers - [email protected] Original Advisory: www.mjltech.net/adv/MJLTECH%20-%20Projectsend%20R572%20XSS.txt...

CVE-2015-2266

message/index.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 does not consider the moodle/site:readallmessages capability before accessing arbitrary conversations, which allows remote authenticated users to obtain sensitive personal-contact and...

CVE-2015-2266

message/index.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 does not consider the moodle/site:readallmessages capability before accessing arbitrary conversations, which allows remote authenticated users to obtain sensitive personal-contact and...

CVE-2015-2266: Exposure of Sensitive Information to an Unauthorized Actor

message/index.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 does not consider the moodle/site:readallmessages capability before accessing arbitrary conversations, which allows remote authenticated users to obtain sensitive personal-contact and...

CVE-2015-4127: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the churchadmin plugin before 0.810 for WordPress allows remote attackers to inject arbitrary web script or HTML via the address parameter, as demonstrated by a request to index.php/2015/05/21/churchadmin-registration-form/...

CVE-2012-4901

Template CMS (version 2.1.1 and earlier) is affected by a Cross‑Site Scripting (CWE-79) vulnerability in the themes_editor parameter passed to admin/index.php during add_template, enabling remote injection of arbitrary HTML/JS. Public advisories (HTB23115) describe the issue and note CSRF concern...

PT-2015-3529

Name of the Vulnerable Software and Affected Versions Template CMS versions 2.1.1 and earlier Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the themes editor parameter in an "add template" action to "admin/index.php". Recommendations F...