CVE-2014-5112: Improper Control of Generation of Code

maint/modules/home/index.php in Fonality trixbox allows remote attackers to execute arbitrary commands via shell metacharacters in the lang parameter...

PT-2014-6285

Name of the Vulnerable Software and Affected Versions concrete5 versions prior to 5.6.3 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header to index.php/download...

PT-2014-6289

Name of the Vulnerable Software and Affected Versions Fonality trixbox affected versions not specified Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the lang parameter in the maint/modules/home/index.php file. Recommendations At the moment...

PT-2014-6283

Name of the Vulnerable Software and Affected Versions Invision Power IP.Board versions 3.4.x through 3.4.6 Description The issue is related to a cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header to the...

CVE-2014-5106: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Invision Power IP.Board aka IPB or Power Board 3.4.x through 3.4.6 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header to admin/install/index.php...

CVE-2014-5018

Incomplete blacklist vulnerability in the autoEscape function in commonhelper.php in LimeSurvey 2.05+ Build 140618 allows remote attackers to conduct cross-site scripting XSS attacks via the GBK charset in the loadname parameter to index.php, related to the survey resume...

CVE-2014-5018: Undefined Security Weakness

Incomplete blacklist vulnerability in the autoEscape function in commonhelper.php in LimeSurvey 2.05+ Build 140618 allows remote attackers to conduct cross-site scripting XSS attacks via the GBK charset in the loadname parameter to index.php, related to the survey resume...

PT-2014-6250

Name of the Vulnerable Software and Affected Versions LimeSurvey versions 2.05 and later Description The issue is related to an incomplete blacklist vulnerability in the autoEscape function. This allows remote attackers to conduct cross-site scripting XSS attacks via the GBK charset in the loadna...

PT-2014-6231

Name of the Vulnerable Software and Affected Versions Joomla! Youtube Gallery com youtubegallery component versions 3.x and 4.x through 4.1.7 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the listid or themeid parameter to "index.php"...

Fonality trixbox - index.php Directory Traversal

Fonality trixbox - index.php Directory Traversal source: https://www.securityfocus.com/bid/68719/info ol-commerce is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input. Exploiting these...

CVE-2014-3992

Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM 3.5.3 allow remote authenticated users to execute arbitrary SQL commands via the 1 entity parameter in an update action to user/fiche.php or 2 sortorder parameter to user/group/index.php...

CVE-2014-3992

Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM 3.5.3 allow remote authenticated users to execute arbitrary SQL commands via the 1 entity parameter in an update action to user/fiche.php or 2 sortorder parameter to user/group/index.php...

CVE-2014-3991

Multiple cross-site scripting XSS vulnerabilities in Dolibarr ERP/CRM 3.5.3 allow remote attackers to inject arbitrary web script or HTML via the 1 dolusejmobile, 2 doloptimizesmallscreen, 3 dolnomousehover, 4 dolhidetopmenu, 5 dolhideleftmenu, 6 mainmenu, or 7 leftmenu parameter to index.php; th...

CVE-2014-3991

Multiple cross-site scripting XSS vulnerabilities in Dolibarr ERP/CRM 3.5.3 allow remote attackers to inject arbitrary web script or HTML via the 1 dolusejmobile, 2 doloptimizesmallscreen, 3 dolnomousehover, 4 dolhidetopmenu, 5 dolhideleftmenu, 6 mainmenu, or 7 leftmenu parameter to index.php; th...

CVE-2014-3992: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM 3.5.3 allow remote authenticated users to execute arbitrary SQL commands via the 1 entity parameter in an update action to user/fiche.php or 2 sortorder parameter to user/group/index.php...

CVE-2014-3991: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Dolibarr ERP/CRM 3.5.3 allow remote attackers to inject arbitrary web script or HTML via the 1 dolusejmobile, 2 doloptimizesmallscreen, 3 dolnomousehover, 4 dolhidetopmenu, 5 dolhideleftmenu, 6 mainmenu, or 7 leftmenu parameter to index.php; th...

CVE-2014-4850

SQL injection vulnerability in index.php in FoeCMS allows remote attackers to execute arbitrary SQL commands via the i parameter...

Sql injection

SQL injection vulnerability in index.php in FoeCMS allows remote attackers to execute arbitrary SQL commands via the i parameter...

CVE-2014-4850: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in FoeCMS allows remote attackers to execute arbitrary SQL commands via the i parameter...

PT-2014-6164

Name of the Vulnerable Software and Affected Versions FoeCMS affected versions not specified Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the i parameter in the "index.php" file. Recommendations At the moment, there is no information about ...