CVE-2013-2690

CVE-2013-2690 is a SQL injection vulnerability in the SynConnect 2.0 login flow of Synchroweb Technology. The flaw affects index.php where an attacker can manipulate the loginid parameter in a logoff action to execute arbitrary SQL commands. Reported in NVD with a base score of 7.5 (HIGH) and net...

CVE-2013-2690: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in Synchroweb Technology SynConnect 2.0 allows remote attackers to execute arbitrary SQL commands via the loginid parameter in a logoff action...

PT-2013-3875

Name of the Vulnerable Software and Affected Versions SynConnect version 2.0 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the loginid parameter in a logoff action in the index.php file. Recommendations For SynConnect version 2.0, update the...

SynConnect SQL Injection

Title: ==== SynConnect - SQL Injection vulnerability Credit: ====== Name: Bhadresh Patel Company/affiliation: Cyberoam Technologies Private Limited Website: www.cyberoam.com CVE: ===== Date: ==== 01-03-2013 CRD: ==== CRD-2013-01 Vendor: ====== Synchroweb Technology is a provider of application...

Joomla! Component com_rsfiles - 'cid' SQL Injection

Title : Joomla Component RSfiles = cid SQL injection Vulnerability Author : ByEge Contact : http://byege.blogspot.com Date : 18.03.2013 S.Page : http://www.rsjoomla.com Dork : inurl:index.php?option=comrsfiles DorkEx :...

Batavi - index.php Cross-Site Scripting

Batavi - index.php Cross-Site Scripting source: https://www.securityfocus.com/bid/58151/info Batavi is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an...

PT-2013-1473

Name of the Vulnerable Software and Affected Versions OrangeHRM versions prior to 2.6.11.2 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the uniqcode or isAdmin parameter to "index.php", or the PATH INFO to...

CVE-2011-5258: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in OrangeHRM before 2.6.11.2 allow remote attackers to inject arbitrary web script or HTML via the 1 uniqcode or 2 isAdmin parameter to index.php; or the 3 PATHINFO to lib/controllers/centralcontroller.php...

webAssist Sql Injection Vulnerability

Exploit for php platform in category web applications 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 +...

CVE-2012-6100

report/outline/index.php in Moodle 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 does not properly enforce the moodle/user:viewhiddendetails capability requirement, which allows remote authenticated users to discover a hidden lastaccess value by reading an activity report...

PT-2013-1890

Name of the Vulnerable Software and Affected Versions Moodle versions 2.2.x through 2.2.6 Moodle versions 2.3.x through 2.3.3 Moodle versions 2.4.x through 2.4.0 Description The issue concerns the improper enforcement of the moodle/user:viewhiddendetails capability requirement in the...

CVE-2012-6100: Undefined Security Weakness

report/outline/index.php in Moodle 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 does not properly enforce the moodle/user:viewhiddendetails capability requirement, which allows remote authenticated users to discover a hidden lastaccess value by reading an activity report...

CVE-2012-6516

SQL injection vulnerability in PHP Ticket System Beta 1 allows remote attackers to execute arbitrary SQL commands via the q parameter to index.php...

CVE-2012-6513

CVE-2012-6513 is an XSS vulnerability in gpEasy CMS 2.3.3: index.php/Admin_Preferences accepts jsoncallback leading to remote injection of arbitrary web script/HTML. Impact: arbitrary script execution in affected contexts. Documented exploit exists (Exploit-DB 37104). No patch/version details pro...

PT-2013-1978

Name of the Vulnerable Software and Affected Versions Joomla! component nBill com nbill version 2.3.2 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the message parameter in an income action to "administrator/index.php"...

PT-2013-1977

Name of the Vulnerable Software and Affected Versions gpEasy CMS version 2.3.3 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the jsoncallback parameter in the index.php/Admin Preferences file. Recommendations For gpEasy C...

PT-2013-1980

Name of the Vulnerable Software and Affected Versions PHP Ticket System Beta 1 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the q parameter to the "index.php" endpoint. Recommendations For PHP Ticket System Beta 1, consider restricting acce...

PT-2013-1979

Name of the Vulnerable Software and Affected Versions eFront versions 3.6.10, 3.6.11 build 15059, and earlier Description The issue allows remote attackers to obtain sensitive information via an invalid courses ID parameter in the lesson info module to "index.php", which reveals the installation...

CVE-2012-6516: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in PHP Ticket System Beta 1 allows remote attackers to execute arbitrary SQL commands via the q parameter to index.php...

CVE-2012-6519: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in modules/poll/index.php in DIY-CMS 1.0 allows remote attackers to execute arbitrary SQL commands via the start parameter to mod.php...