13400 matches found
CVE-2012-6512: Exposure of Sensitive Information to an Unauthorized Actor
The Organizer plugin 1.2.1 for WordPress allows remote attackers to obtain the installation path via unspecified vectors to 1 pluginhook.php, 2 page/index.php, 3 page/dir.php 4 page/options.php, 5 page/resize.php, 6 page/upload.php, 7 page/users.php, or 8 page/view.php...
CVE-2012-6515: Exposure of Sensitive Information to an Unauthorized Actor
eFront 3.6.10, 3.6.11 build 15059, and earlier allows remote attackers to obtain sensitive information via invalid coursesID parameter in the lessoninfo module to index.php, which reveals the installation path in an error message...
PT-2013-1976
Name of the Vulnerable Software and Affected Versions Organizer plugin version 1.2.1 for WordPress Description The issue allows remote attackers to obtain the installation path via unspecified vectors to various PHP files, including "plugin hook.php", "page/index.php", "page/dir.php",...
CVE-2012-6513: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in index.php/AdminPreferences in gpEasy CMS 2.3.3 allows remote attackers to inject arbitrary web script or HTML via the jsoncallback parameter...
Joomla Collector Shell Upload
Exploit Title:Joomla comcollecter shell upload Author: Red Dragonal Alb0zZ Team Home :HackForums.AL,alb0zz.in Date :19/01/2013 Category:: web apps Google dork: inurl:index.php?option=comcollector Tested on: Windows XP Download: http://www.steevo.fr/en/download Home Page: http://www.steevo.fr/...
WordPress Events Manager Plugin <= 5.3.4 - Multiple XSS
Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML via the "scope" parameter to index.php. Solution Update the plugin...
CVE-2012-5874
Multiple SQL injection vulnerabilities in the 1 updatewhosonlinereg and 2 updatewhosonlineguest functions in Elite Bulletin Board before 2.1.22 allow remote attackers to execute arbitrary SQL commands via the PATHINFO to a checkuser.php, b groups.php, c index.php, d login.php, e quicklogin.php, f...
CVE-2012-6498: Undefined Security Weakness
Unrestricted file upload vulnerability in index.php in Atomymaxsite 2.5 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file, as exploited in the wild in October 2012...
PT-2013-1962
Name of the Vulnerable Software and Affected Versions Atomymaxsite versions 2.5 and earlier Description The issue allows remote attackers to execute arbitrary code by uploading a file with an executable extension to the index.php file, and then accessing it via a direct request to the file. This...
CVE-2012-5666
Cross-site scripting XSS vulnerability in bookmarks/js/bookmarks.js in ownCloud 4.0.x before 4.0.10 and 4.5.x before 4.5.5 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to apps/bookmark/index.php...
PT-2013-1832
Name of the Vulnerable Software and Affected Versions ownCloud versions 4.0.x through 4.0.9 ownCloud versions 4.5.x through 4.5.4 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the PATH INFO to "apps/bookmark/index.php"...
CVE-2012-5666: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in bookmarks/js/bookmarks.js in ownCloud 4.0.x before 4.0.10 and 4.5.x before 4.5.5 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to apps/bookmark/index.php...
Invision Power Services Invision Gallery 1.0.1 Multiple SQL Injection Vulnerabilities
Exploit for php platform in category web applications source: http://www.securityfocus.com/bid/9944/info It has been reported that Invision Gallery may be prone to multiple sql injection vulnerabilities, allowing an attacker to influence SQL query logic. The issues exist due to insufficient...
PT-2012-5666
Name of the Vulnerable Software and Affected Versions SimpleInvoices versions prior to stable-2012-1-CIS3000 Description The issue allows remote attackers to inject arbitrary web script or HTML via various fields and parameters, including the having parameter in a manage action to "index.php", th...
CVE-2012-4932: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in SimpleInvoices before stable-2012-1-CIS3000 allow remote attackers to inject arbitrary web script or HTML via 1 the having parameter in a manage action to index.php; 2 the Email field in an Add User action; 3 the Customer Name field in an Add...
Server: XSS vulnerability in bookmarks
A cross-site scripting XSS vulnerability in ownCloud before 4.5.5 and 4.0.10 allow remote attackers to inject arbitrary web script or HTML via the PATH data to index.php in apps/bookmark/ For more information please consult the official advisory. This advisory is licensed CC BY-SA 4.0...
FOOT Gestion CMS SQL Injection
Product: FOOT Gestion Version: - Vendor: Winsoft Vendor site:http://www.footgestion.ch Status: fixed Level: High ========= Description ========= FOOT Gestion is a soccer team management CMS. The solution is based on a software and a CMS website. The website module is affected by a SQL injection...
Amoy Empire system background cookie spoofing vulnerability and the background to get shell-vulnerability warning-the black bar safety net
The accidental discovery of Amoy Empire free version of the background can be a cookie trick Tools: the Veteran's cookies'cheat tool Keywords: classification - Mall - brand - woman - man - beauty - shoes and bags - digital - home - food First open the tool the cookie to COOKIEadminuser=admin;...
Kleeja Upload Center Script CRLF Injection
Exploit Title : Kleeja Upload Center Script CRLF injection Author:Ashiyane Digital Security Team home: http://ashiyane.org/forums version:1.0.1 software link: www.Kleeja.com Date:Sunday - 2012 25 November Google Dork: intext:Kleeja © 2007-2012. All rights reserved Type: CRLF injection Tested...
