Joomla MacGallery 1.5 /index.php 任意文件下载漏洞

No description provided by source...

CVE-2014-5257: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Forma Lms before 1.2.1 p01 allow remote attackers to inject arbitrary web script or HTML via the 1 idcustom parameter in an amanmenu request or 2 idgame parameter in an alms/games/edit request to appCore/index.php...

PT-2014-6371

Name of the Vulnerable Software and Affected Versions Forma Lms versions prior to 1.2.1 p01 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the id custom parameter in an "amanmenu" request or the id game parameter in an...

CVE-2014-5387: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in EllisLab ExpressionEngine before 2.9.1 allow remote authenticated users to execute arbitrary SQL commands via the 1 columnfilter or 2 category parameter to system/index.php or the 3 tblsort0 parameter in the comment module to system/index.php...

PT-2014-6444

Name of the Vulnerable Software and Affected Versions EllisLab ExpressionEngine versions prior to 2.9.1 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This can be achieved via the column filter or category parameter to "system/index.php" or the tbl sort...

Incredible PBX remote command execution exploit

!/usr/bin/perl Title: Incredible PBX remote command execution exploit Author: Simo Ben youssef Contact: SimoatMorxploitcom Discovered: 1 September 2014 Coded: 21 October 2014 Published: 21 October 2014 MorXploit Research http://www.MorXploit.com Vendor: PBX in a Flash Vendor url:...

CVE-2014-7987

Cross-site scripting XSS vulnerability in EspoCRM before 2.6.0 allows remote attackers to inject arbitrary web script or HTML via the desc parameter in an errors action to install/index.php...

CVE-2014-7985

Directory traversal vulnerability in EspoCRM before 2.6.0 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the action parameter to install/index.php...

CVE-2014-7986

install/index.php in EspoCRM before 2.6.0 allows remote attackers to re-install the application via a 1 value in the installProcess parameter...

CVE-2014-7986: Undefined Security Weakness

install/index.php in EspoCRM before 2.6.0 allows remote attackers to re-install the application via a 1 value in the installProcess parameter...

CVE-2014-7987: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in EspoCRM before 2.6.0 allows remote attackers to inject arbitrary web script or HTML via the desc parameter in an errors action to install/index.php...

PT-2014-8357

Name of the Vulnerable Software and Affected Versions EspoCRM versions prior to 2.6.0 Description The issue allows remote attackers to include and execute arbitrary local files via a .. dot dot in the action parameter to "install/index.php" API endpoint. Recommendations For versions prior to 2.6....

PT-2014-8358

Name of the Vulnerable Software and Affected Versions EsppoCRM versions prior to 2.6.0 Description The issue allows remote attackers to re-install the application. This can be achieved by setting the installProcess parameter to 1 in the install/index.php file. Recommendations For versions prior t...

PT-2014-8359

Name of the Vulnerable Software and Affected Versions EspoCRM versions prior to 2.6.0 Description The issue allows remote attackers to inject arbitrary web script or HTML via the desc parameter in an errors action to "install/index.php". This is a cross-site scripting XSS issue. Recommendations F...

CVE-2014-7985: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in EspoCRM before 2.6.0 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the action parameter to install/index.php...

Etiko CMS index.php cross-site scripting vulnerability-vulnerability warning-the black bar safety net

Affected system: Etiko Etiko CMS Description: CVECAN ID: CVE-2 0 1 4-8 5 0 5 Etiko CMS is a content management system. Etiko CMS did not effectively verify the index. php script input, in the realization on the presence of cross-site scripting vulnerability, a remote attacker with the structure o...

PT-2014-8569

Name of the Vulnerable Software and Affected Versions Etiko CMS affected versions not specified Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the page id parameter to "loja/index.php" or the article id parameter to "index.php"...

PT-2014-8568

Name of the Vulnerable Software and Affected Versions Etiko CMS affected versions not specified Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. Specifically, the vulnerabilities...

CVE-2014-8506: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Etiko CMS allow remote attackers to execute arbitrary SQL commands via the 1 pageid parameter to loja/index.php or 2 articleid parameter to index.php...

CVE-2014-8505: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Etiko CMS allow remote attackers to inject arbitrary web script or HTML via the 1 pageid parameter to loja/index.php or 2 articleid parameter to index.php...