CVE-2014-100025: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in index.php/userdata/insertuser in Savsoft Quiz allows remote attackers to hijack the authentication of administrators for requests that create an administrator account via a crafted request...

CVE-2014-10007: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Maian Weblog 4.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 name, 2 email, or 3 subject parameter in a contact action to index.php...

CVE-2014-100021: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in symfony/web/index.php/pim/viewEmployeeList in OrangeHRM before 3.1.2 allows remote attackers to inject arbitrary web script or HTML via the empsearchemployeenameempId parameter...

PT-2015-3681

Name of the Vulnerable Software and Affected Versions DomPHP versions 0.83 and earlier Description A directory traversal issue exists, allowing remote attackers to have an unspecified impact by including a .. dot dot in the url parameter to the "photoalbum/index.php" endpoint. Recommendations For...

CVE-2014-10037: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in DomPHP 0.83 and earlier allows remote attackers to have unspecified impact via a .. dot dot in the url parameter to photoalbum/index.php...

PT-2015-3616

Name of the Vulnerable Software and Affected Versions ClanSphere version 2011.4 Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the where parameter in a list action to "index.php". Recommendations For ClanSphere version 2011.4, consider...

PT-2015-3679

Name of the Vulnerable Software and Affected Versions couponPHP versions prior to 1.2.0 Description The issue concerns multiple cross-site scripting XSS vulnerabilities in the admin area. These vulnerabilities allow remote administrators to inject arbitrary web script or HTML via various...

PT-2015-3651

Name of the Vulnerable Software and Affected Versions Maian Weblog versions 4.0 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML via the name, email, or subject parameter in a contact action to "index.php". This can lead to cross-site scripting XSS...

CVE-2014-100010: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in ClanSphere 2011.4 allows remote attackers to inject arbitrary web script or HTML via the where parameter in a list action to index.php...

Multiple HTML Injection Vulnerabilities in BEdita CMS 'index.php'

BEdita is a web development framework that provides a full-featured content management system. Multiple HTML injection vulnerabilities exist in BEdita CMS 'index.php' because it fails to properly filter user-supplied input. An attacker can execute the provided HTML and script code in the context ...

CVE-2015-0917

Cross-site scripting XSS vulnerability in the backend in Kajona before 4.6.3 allows remote attackers to inject arbitrary web script or HTML via the action parameter to index.php...

CVE-2015-0917

Cross-site scripting XSS vulnerability in the backend in Kajona before 4.6.3 allows remote attackers to inject arbitrary web script or HTML via the action parameter to index.php...

CVE-2015-0917

Summary: CVE-2015-0917 is an XSS vulnerability in Kajona CMS backend before version 4.6.3, exploitable via the action parameter to index.php. Connected sources confirm the affected product and vulnerable parameter; no explicit remediation details are provided in the supplied documents. The exploi...

PT-2015-4967

Name of the Vulnerable Software and Affected Versions Kajona versions prior to 4.6.3 Description A cross-site scripting XSS issue exists in the backend of Kajona, allowing remote attackers to inject arbitrary web script or HTML via the action parameter to "index.php". Recommendations For versions...

CVE-2015-0917: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the backend in Kajona before 4.6.3 allows remote attackers to inject arbitrary web script or HTML via the action parameter to index.php...

PT-2015-4269

Name of the Vulnerable Software and Affected Versions HumHub versions 0.10.0-rc.1 and earlier Description The issue allows remote authenticated users to execute arbitrary SQL commands via the from parameter to "index.php". This can be leveraged for cross-site scripting XSS attacks via a request...

Sql injection

Multiple SQL injection vulnerabilities in index.php in SweetRice CMS before 0.6.7.1 allow remote attackers to execute arbitrary SQL commands via 1 the filename parameter in an attachment action, 2 the post parameter in a showcomment action, 3 the sys-name parameter in an rssfeed action, or 4 the...

CVE-2010-5317

Multiple SQL injection vulnerabilities in index.php in SweetRice CMS before 0.6.7.1 allow remote attackers to execute arbitrary SQL commands via 1 the filename parameter in an attachment action, 2 the post parameter in a showcomment action, 3 the sys-name parameter in an rssfeed action, or 4 the...

CVE-2010-5317: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in index.php in SweetRice CMS before 0.6.7.1 allow remote attackers to execute arbitrary SQL commands via 1 the filename parameter in an attachment action, 2 the post parameter in a showcomment action, 3 the sys-name parameter in an rssfeed action, or 4 the...

CVE-2010-5316: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in as/index.php in SweetRice CMS before 0.6.7.1 allows remote attackers to inject arbitrary web script or HTML via a topheight cookie...