13401 matches found
PyroCMS "email"跨站脚本漏洞
PyroCMS是一款内容管理系统。 由于传递到index.php/register中"email" POST参数的输入在返回用户前未能正确过滤，攻击者可以利用漏洞在受影响站点上下文的用户浏览器会话中执行任意HTML和脚本代码。 0 PyroCMS 2.2.3 目前厂商暂无提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： https://www.pyrocms.com/...
storytlr "search"跨站脚本漏洞
storytlr是一款博客平台。 由于通过"search"参数传递到index.php/search/的输入在protected/application/public/controllers/SearchController.php中被返回用户前未能正确过滤，攻击者可以利用漏洞在受影响站点上下文的用户浏览器会话中执行任意HTML和脚本代码。 0 storytlr 1.2 目前厂商暂无提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://storytlr.org/...
CVE-2014-2316
Technical details for CVE-2014-2316 are not provided in the connected documents. The initial description notes an SQL injection in the Search Everything WordPress plugin, but no further specifics (versions, root cause, exploit, or patch) are present. Monitor for updates.
CVE-2014-2316: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in sesearchdefault in the Search Everything plugin before 7.0.3 for WordPress allows remote attackers to execute arbitrary SQL commands via the s parameter to index.php. NOTE: some of these details are obtained from third party information...
CVE-2014-1944: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in Ilch CMS 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the text parameter to index.php/guestbook/index/newentry...
PT-2014-4619
Name of the Vulnerable Software and Affected Versions Search Everything plugin versions prior to 7.0.3 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the s parameter to the "index.php" endpoint. Recommendations For versions prior to 7.0.3,...
PT-2014-4376
Name of the Vulnerable Software and Affected Versions Ilch CMS versions 2.0 and earlier Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the text parameter to "index.php/guestbook/index/newentry". Recommendations For Ilch CMS versions 2.0...
Aker Secure Mail Gateway reflected XSS vulnerability
Overview Aker Secure Mail Gateway 2.5.2 and previous versions contain a reflected cross-site scripting vulnerability. CWE-79 Description CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' - CVE-2013-6037Aker Secure Mail Gateway 2.5.2 and previous versions...
Sql injection
SQL injection vulnerability in Apptha WordPress Video Gallery 2.0, 1.6, and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the playid parameter to index.php...
PT-2014-2680
Name of the Vulnerable Software and Affected Versions Apptha WordPress Video Gallery versions 2.0, 1.6, and earlier Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the playid parameter to "index.php". Recommendations For Apptha WordPress Video...
CVE-2013-3478: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in Apptha WordPress Video Gallery 2.0, 1.6, and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the playid parameter to index.php...
Cross site scripting
Cross-site scripting XSS vulnerability in the login page in Open Web Analytics OWA before 1.5.6 allows remote attackers to inject arbitrary web script or HTML via the owauserid parameter to index.php...
CVE-2014-1456
Cross-site scripting XSS vulnerability in the login page in Open Web Analytics OWA before 1.5.6 allows remote attackers to inject arbitrary web script or HTML via the owauserid parameter to index.php...
CVE-2014-1456: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the login page in Open Web Analytics OWA before 1.5.6 allows remote attackers to inject arbitrary web script or HTML via the owauserid parameter to index.php...
PT-2014-2588
Name of the Vulnerable Software and Affected Versions SimpleHRM versions 2.3, 2.2, and earlier Description The issue allows remote attackers to execute arbitrary SQL commands via the username parameter to "index.php/user/setLogin". This is a SQL injection vulnerability in the login page,...
CVE-2013-2498: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in the login page in flexycms/modules/user/usermanager.php in SimpleHRM 2.3, 2.2, and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter to index.php/user/setLogin...
PT-2014-4192
Name of the Vulnerable Software and Affected Versions Open Web Analytics OWA versions prior to 1.5.6 Description A cross-site scripting XSS issue exists in the login page, allowing remote attackers to inject arbitrary web script or HTML via the owa user id parameter to "index.php". Recommendation...
couponPHP CMS 1.0 Multiple Stored XSS and SQL Injection Vulnerabilities
Summary couponPHP is a revolutionary content management system for running Coupon and Deal websites. It is feature rich, powerful, beautifully designed and fully automatic. Description couponPHP is vulnerable to multiple Stored XSS and SQL Injection issues. Input passed via the parameters...
Joomla! Wire Immogest组件'index.php' SQL注入漏洞
Bugtraq ID:65606 Joomla!是一套在国外相当知名的内容管理系统。 Joomla! Wire Immogest组件'index.php'不正确过滤用户提交给'id'参数的数据，允许远程攻击者利用漏洞提交特制的SQL查询，可操作或者获取数据库数据。 0 Joomla! Wire Immogest 目前没有详细解决方案提供： http://www.joomla.org/...