PT-2015-3503

Name of the Vulnerable Software and Affected Versions PhotoSmash plugin version 1.0.1 for WordPress Description The issue is related to a cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary web script or HTML via the action parameter in the index.php file...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in templates/2k11/admin/overview.inc.tpl in Serendipity before 2.0-rc2 allow remote attackers to inject arbitrary web script or HTML via a blog comment in the QUERYSTRING to serendipity/index.php...

Sql injection

bbfuncunsub.php in MiniBB 3.1 before 20141127 uses an incorrect regular expression, which allows remote attackers to conduct SQl injection attacks via the code parameter in an unsubscribe action to index.php...

CVE-2014-9254

bbfuncunsub.php in MiniBB 3.1 before 20141127 uses an incorrect regular expression, which allows remote attackers to conduct SQl injection attacks via the code parameter in an unsubscribe action to index.php...

PT-2014-9009

Name of the Vulnerable Software and Affected Versions Serendipity versions prior to 2.0-rc2 Description The issue allows remote attackers to inject arbitrary web script or HTML via a blog comment in the QUERY STRING to serendipity/index.php, potentially leading to cross-site scripting XSS attacks...

CVE-2014-9254: Improper Neutralization of Special Elements used in an SQL Command

bbfuncunsub.php in MiniBB 3.1 before 20141127 uses an incorrect regular expression, which allows remote attackers to conduct SQl injection attacks via the code parameter in an unsubscribe action to index.php...

CVE-2012-1203

The CVE-2012-1203 entry describes a CSRF vulnerability in SyndeoCMS (starnet/index.php) affecting version 3.0 and earlier. The underlying issue is CSRF that allows remote attackers to hijack an administrator’s session to perform add-user actions via a save_user request. Affected component/file: s...

CVE-2012-1203: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in starnet/index.php in SyndeoCMS 3.0 and earlier allows remote attackers to hijack the authentication of administrators for requests that add user accounts via a saveuser action...

PT-2014-3023

Name of the Vulnerable Software and Affected Versions Softaculous Webuzo versions prior to 2.1.4 Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in a SOFTCookies sid cookie within a "login" action. This is related to the index.php file...

CVE-2013-6041: Improper Neutralization of Special Elements used in an OS Command

index.php in Softaculous Webuzo before 2.1.4 allows remote attackers to execute arbitrary commands via shell metacharacters in a SOFTCookies sid cookie within a login action...

FreePBX Framework Asterisk Recording Interface unserialize Code Execution (CVE-2014-7235)

A code execution vulnerability exists in FreePBX. The vulnerability is due to an input validation issue in the index.php file of the recordings directory...

PT-2014-8881

Name of the Vulnerable Software and Affected Versions PBBoard version 3.0.1 before 20141128 Description A SQL injection issue exists in the CheckEmail function, allowing remote attackers to execute arbitrary SQL commands via the email parameter in the register page to "index.php". Recommendations...

CVE-2014-9241

Multiple cross-site scripting XSS vulnerabilities in MyBB aka MyBulletinBoard 1.8.x before 1.8.2 allow remote attackers to inject arbitrary web script or HTML via the 1 type parameter to report.php, 2 signature parameter in a doeditsig action to usercp.php, or 3 title parameter in the...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in MyBB aka MyBulletinBoard 1.8.x before 1.8.2 allow remote attackers to inject arbitrary web script or HTML via the 1 type parameter to report.php, 2 signature parameter in a doeditsig action to usercp.php, or 3 title parameter in the...

CVE-2014-9241

Multiple cross-site scripting XSS vulnerabilities in MyBB aka MyBulletinBoard 1.8.x before 1.8.2 allow remote attackers to inject arbitrary web script or HTML via the 1 type parameter to report.php, 2 signature parameter in a doeditsig action to usercp.php, or 3 title parameter in the...

CVE-2014-8774

Cross-site scripting XSS vulnerability in manager/index.php in MODX Revolution 2.x before 2.2.15 allows remote attackers to inject arbitrary web script or HTML via the contextkey parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in index.php in SunHater KCFinder 3.11 and earlier allows remote attackers to inject arbitrary web script or HTML via 1 file or 2 directory folder name of an uploaded file...

CVE-2014-3988

Cross-site scripting XSS vulnerability in index.php in SunHater KCFinder 3.11 and earlier allows remote attackers to inject arbitrary web script or HTML via 1 file or 2 directory folder name of an uploaded file...

CVE-2014-9241: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in MyBB aka MyBulletinBoard 1.8.x before 1.8.2 allow remote attackers to inject arbitrary web script or HTML via the 1 type parameter to report.php, 2 signature parameter in a doeditsig action to usercp.php, or 3 title parameter in the...

CVE-2014-3988: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in SunHater KCFinder 3.11 and earlier allows remote attackers to inject arbitrary web script or HTML via 1 file or 2 directory folder name of an uploaded file...