CVE-2013-6341

CVE-2013-6341 : Dokeos up to 2.2 RC2 has a SQL injection via the GET parameter “language” sent to /index.php. Root cause: insufficient validation of the language parameter. Impact: remote attacker can execute arbitrary SQL commands against the application database (high risk). Affected: Dokeos 2....

PT-2013-6003

Name of the Vulnerable Software and Affected Versions Dokeos versions 2.2 RC2 and earlier Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands. This is achieved by manipulating the language parameter to the "index.php" endpoint. Recommendations For Dokeos...

PT-2013-5367

Name of the Vulnerable Software and Affected Versions RockMongo versions 1.1.5 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML via the db parameter on the login page or the username parameter in a login.index action to "index.php" and other...

CVE-2013-6341: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Dokeos 2.2 RC2 and earlier allows remote attackers to execute arbitrary SQL commands via the language parameter to index.php...

CVE-2013-6875: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in functions/prependadm.php in Nagios Core Config Manager in Nagios XI before 2012R2.4 allows remote attackers to execute arbitrary SQL commands via the tfPassword parameter to nagiosql/index.php...

PT-2013-6164

Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 2012R2.4 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the tfPassword parameter to the "nagiosql/index.php" endpoint. Recommendations For versions prior to...

CVE-2013-4573

Cross-site scripting XSS vulnerability in the ZeroRatedMobileAccess extension for MediaWiki 1.19.x before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote attackers to inject arbitrary web script or HTML via the "to" parameter to index.php...

CVE-2013-4573

Cross-site scripting XSS vulnerability in the ZeroRatedMobileAccess extension for MediaWiki 1.19.x before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote attackers to inject arbitrary web script or HTML via the "to" parameter to index.php...

CVE-2013-4573: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the ZeroRatedMobileAccess extension for MediaWiki 1.19.x before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote attackers to inject arbitrary web script or HTML via the "to" parameter to index.php...

PT-2013-5081

Name of the Vulnerable Software and Affected Versions MediaWiki versions 1.19.x through 1.19.8 MediaWiki versions 1.20.x through 1.20.7 MediaWiki versions 1.21.x through 1.21.2 Description A cross-site scripting issue exists due to insufficient validation of user input. This allows remote attacke...

phpweb /down/class/index.php SQL注入漏洞

No description provided by source...

Cross site scripting

Cross-site scripting XSS vulnerability in Zikula Application Framework before 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the returnpage parameter to index.php...

CVE-2013-6168

Cross-site scripting XSS vulnerability in Zikula Application Framework before 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the returnpage parameter to index.php...

CVE-2013-6168: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Zikula Application Framework before 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the returnpage parameter to index.php...

PT-2013-5954

Name of the Vulnerable Software and Affected Versions Zikula Application Framework versions prior to 1.3.6 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the returnpage parameter to "index.php". Recommendations For versions prior to...

BoltWire <= 3.5 Multiple XSS Vulnerabilities

BoltWire is prone to multiple cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2013-5688: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in index.php in AjaXplorer 5.0.2 and earlier allow remote authenticated users to read arbitrary files via a ../%00 dot dot backslash encoded null byte in the file parameter in a 1 download or 2 getcontent action, or 3 upload arbitrary files via a ../%0...

PT-2013-5724

Name of the Vulnerable Software and Affected Versions AjaXplorer versions 5.0.2 and earlier Description The issue allows remote authenticated users to read arbitrary files or upload files to arbitrary locations via directory traversal vulnerabilities in the index.php file. This can be achieved by...

Onpub CMS 1.41.5 - Multiple SQL Injections

Onpub CMS 1.41.5 - Multiple SQL Injections Document Title: =============== Onpub CMS 1.4 & 1.5 - Multiple SQL Injection Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1120 Release Date: ============= 2013-10-26 Vulnerability Laboratory I...

Onpub CMS 1.4/1.5 - Multiple SQL Injections

Document Title: =============== Onpub CMS 1.4 & 1.5 - Multiple SQL Injection Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1120 Release Date: ============= 2013-10-26 Vulnerability Laboratory ID VL-ID: ==================================...