CVE-2015-1435: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in my little forum before 2.3.4 allows remote attackers to inject arbitrary web script or HTML via the back parameter to index.php...

PT-2015-5285

Name of the Vulnerable Software and Affected Versions my little forum versions prior to 2.3.4 Description The issue allows remote administrators to execute arbitrary SQL commands. This can be achieved via the letter parameter in a user action or the edit category parameter to "index.php"...

my little forum '/index.php' cross-site scripting vulnerability

my little forum is a forum program. A cross-site scripting vulnerability exists in my little forum. The input passed to "/index.php" via the "back" GET parameter is not properly filtered before being used by the user. This allows remote attackers to trick a logged in user into opening a specially...

PT-2015-5362

Name of the Vulnerable Software and Affected Versions u5CMS versions prior to 3.9.4 Description The issue allows remote attackers to inject arbitrary web script or HTML via various parameters to different PHP files. The affected parameters include c, i, l, p to index.php, a or b to...

CVE-2015-1575: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in u5CMS before 3.9.4 allow remote attackers to inject arbitrary web script or HTML via the 1 c, 2 i, 3 l, or 4 p parameter to index.php; the 5 a or 6 b parameter to u5admin/cookie.php; the name parameter to 7 copy.php or 8 delete.php in u5admin/;...

CVE-2015-1514

Multiple SQL injection vulnerabilities in FancyFon FAMOC before 3.17.4 allow 1 remote attackers to execute arbitrary SQL commands via the device ID REST parameter PATHINFO to /ajax.php or 2 remote authenticated users to execute arbitrary SQL commands via the order parameter to index.php...

CVE-2015-1512

Multiple cross-site scripting XSS vulnerabilities in FancyFon FAMOC before 3.17.4 allow remote attackers to inject arbitrary web script or HTML via the 1 LoginFormusername to ui/system/login or the 2 order or 3 myorgs to index.php...

Sql injection

Multiple SQL injection vulnerabilities in FancyFon FAMOC before 3.17.4 allow 1 remote attackers to execute arbitrary SQL commands via the device ID REST parameter PATHINFO to /ajax.php or 2 remote authenticated users to execute arbitrary SQL commands via the order parameter to index.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in FancyFon FAMOC before 3.17.4 allow remote attackers to inject arbitrary web script or HTML via the 1 LoginFormusername to ui/system/login or the 2 order or 3 myorgs to index.php...

CVE-2015-1512: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in FancyFon FAMOC before 3.17.4 allow remote attackers to inject arbitrary web script or HTML via the 1 LoginFormusername to ui/system/login or the 2 order or 3 myorgs to index.php...

PT-2015-5337

Name of the Vulnerable Software and Affected Versions FancyFon FAMOC versions prior to 3.17.4 Description The issue allows remote attackers to execute arbitrary SQL commands via the device ID REST parameter in the /ajax.php API endpoint, and also allows remote authenticated users to execute...

Vpersian CMS SQL Injection Vulnerability

Remote SQL injection vulnerabilities in vperisan cms . Exploit Title : Vpersian CMS SQL Injection and Authentication bypass Author : Abolfazl74 Home page Link : http://vpersian.net Date : 03/02/2015 Version: All versions Google dork: intext:"VPersian CMS" email : email protected // Vulnerability...

FreePBX /recordings/index.php 'ari_auth' Cookie Authentication Bypass

The version of FreePBX hosted on the remote web server is affected by an authentication bypass vulnerability in the FreePBX ARI Framework module / Asterisk Recording Interface ARI. A remote, unauthenticated attacker can exploit this issue to gain full administrator access to the FreePBX server by...

Sql injection

Multiple SQL injection vulnerabilities in xlinkerz ecommerceMajor allow remote attackers to execute arbitrary SQL commands via the 1 productbycat parameter to product.php, or 2 username or 3 password parameter to admin/index.php...

CVE-2015-1476: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in xlinkerz ecommerceMajor allow remote attackers to execute arbitrary SQL commands via the 1 productbycat parameter to product.php, or 2 username or 3 password parameter to admin/index.php...

CVE-2015-1450

CVE-2015-1450 is a SQL injection vulnerability in Restaurant Biller. The issue arises because the cid parameter in the category action to index.php is not properly filtered, allowing remote attackers to execute arbitrary SQL commands. Affected component: Restaurant Biller category action handling...

PT-2015-5292

Name of the Vulnerable Software and Affected Versions Restaurant Biller affected versions not specified Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the cid parameter in a category action to "index.php". Recommendations At the moment, there...

CVE-2015-1450: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Restaurant Biller allows remote attackers to execute arbitrary SQL commands via the cid parameter in a category action to index.php...

Sql injection

Multiple SQL injection vulnerabilities in Gecko CMS 2.2 and 2.3 allow remote administrators to execute arbitrary SQL commands via the 1 jakdeletelog or 2 ssp parameter to admin/index.php...

CVE-2015-1422: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Gecko CMS 2.2 and 2.3 allow remote attackers to inject arbitrary web script or HTML via the 1 horder, 2 jakcatid, 3 jakcontent, 4 jakcss, 5 jakdeletelog, 6 jakemail, 7 jakextfile, 8 jakfile, 9 jakhookshow, 10 jakimg, 11 jakjavascript, 12...