CVE-2013-5309: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in install/forumdata/src/customfields.inc.t in FUDforum 3.0.4.1 and earlier, when registering a new user, allows remote attackers to inject arbitrary web script or HTML via a custom profile field to index.php. NOTE: some of these details are obtained from...

PT-2013-5469

Name of the Vulnerable Software and Affected Versions FUDforum versions 3.0.4.1 and earlier Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via a custom profile field to "index.php" when registering a new user. Recommendations...

Sql injection

SQL injection vulnerability in core/inc/bigtree/cms.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to execute arbitrary SQL commands via the PATHINFO to index.php...

CVE-2013-4879

SQL injection vulnerability in core/inc/bigtree/cms.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to execute arbitrary SQL commands via the PATHINFO to index.php...

CVE-2013-4879: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in core/inc/bigtree/cms.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to execute arbitrary SQL commands via the PATHINFO to index.php...

CVE-2013-4789

SQL injection vulnerability in modules/rss/rss.php in Cotonti before 0.9.14 allows remote attackers to execute arbitrary SQL commands via the "c" parameter to index.php...

CVE-2013-4789: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in modules/rss/rss.php in Cotonti before 0.9.14 allows remote attackers to execute arbitrary SQL commands via the "c" parameter to index.php...

PT-2013-5195

Name of the Vulnerable Software and Affected Versions Cotonti versions prior to 0.9.14 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the "c" parameter to the API endpoint "index.php". Recommendations For versions prior to 0.9.14, update to...

Linesis SQL Injection

/ / / \ / / / / / / / / / / / // / / / / / / // / // / / / / | // / / / / / // / / / // / /,// /////,// ///// , / // Linesis index.php,Kid SQL Injection Vulnerability AuthorPentester: Miyachung Special Thanks : All Janissaries TeamB127Y,eno7,TheMirkin,PaRaNTeZ,M-A,n4sss Dork : "Powered by...

Ginkgo CMS - index.php?rang SQL Injection

Ginkgo CMS - index.php?rang SQL Injection /\ \ /\ \ /\ \ /\ \ /\ \ /\ \ /\ /\ \ \ \ \ //\ \///'/'\ \ \ \ \ /'\ \ \ \L\ \ \ \ \ \ \ \ \ /\ /\ \ \ \ \ //'/' \ \ \ /'\ /'\ \ , \ \ , /\ \ \ \ \ \ \ \L\ \ \ \ \ \ \ //'/' \ \ \ \ /\ \L./\ /\ \ \\ \ \ \ \ \ \ \ \ /\ / /\/\\ \ \ /.\...

Ginkgo CMS - 'index.php?rang' SQL Injection

/\ \ /\ \ /\ \ /\ \ /\ \ /\ \ /\ /\ \ \ \ \ //\ \///'/'\ \ \ \ \ /'\ \ \ \L\ \ \ \ \ \ \ \ \ /\ /\ \ \ \ \ //'/' \ \ \ /'\ /'\ \ , \ \ , /\ \ \ \ \ \ \ \L\ \ \ \ \ \ \ //'/' \ \ \ \ /\ \L./\ /\ \ \\ \ \ \ \ \ \ \ \ /\ / /\/\\ \ \ /.\ \\ \ \/\\ \ \ \ // // ////...

CVE-2013-4997: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving a JavaScript event in 1 an anchor identifier to setup/index.php or 2 a chartTitle aka chart title value...

CVE-2013-3515

Multiple cross-site scripting XSS vulnerabilities in OpenX Source 2.8.10 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 package parameter to www/admin/plugin-index.php or the 2 group parameter to www/admin/plugin-settings.php...

CVE-2013-3515

Multiple cross-site scripting XSS vulnerabilities in OpenX Source 2.8.10 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 package parameter to www/admin/plugin-index.php or the 2 group parameter to www/admin/plugin-settings.php...

PT-2013-5321

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions 3.5.x through 3.5.8.1 Description The issue allows remote attackers to inject arbitrary web script or HTML via vectors involving a JavaScript event in 1 an anchor identifier to "setup/index.php" or 2 a chartTitle aka chart...

PT-2013-4449

Name of the Vulnerable Software and Affected Versions OpenX Source versions 2.8.10 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML, which can lead to cross-site scripting XSS attacks. This is possible via the package parameter to...

CVE-2013-3515: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in OpenX Source 2.8.10 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 package parameter to www/admin/plugin-index.php or the 2 group parameter to www/admin/plugin-settings.php...

CVE-2013-2242

mod/chat/guisockets/index.php in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, and 2.5.x before 2.5.1 does not consider the mod/chat:chat capability before authorizing daemon-mode chat, which allows remote authenticated users to bypass intended access...

CVE-2013-2242

Summary: CVE-2013-2242 affects Moodle versions up to 2.5.x, where the chat daemon could be accessed by remote authenticated users due to insufficient checks on mod/chat:chat capability before authorizing daemon-mode chat. This could bypass intended access restrictions via an HTTP session to a cha...

metinfo 5.1.7 getshell 0day vulnerabilities attached to the use of the Exp-bug warning-the black bar safety net

1:code analysis about/index.php $filpy = basenamedirnameFILE; $fmodule=1; requireonce ‘../include/module.php’; requireonce $module; Binding metinfo global variables covering the mechanisms can contain files Test:http://w/coder/metinfo/about/? module=../robots. txt&fmodule=7 2:getshell Find a can...