CVE-2012-4231

CVE-2012-4231 corresponds to an XSS flaw in jCore’s admin/index.php prior to 1.0pre2. The vulnerability arises from insufficient sanitization of the path parameter in the GET request, allowing an attacker to inject arbitrary HTML/Script that is executed in the victim’s browser (context of the aff...

CVE-2012-4232

SQL injection vulnerability in admin/index.php in jCore before 1.0pre2 allows remote attackers to execute arbitrary SQL commands via the memberloginid cookie...

CVE-2012-1900: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in admin/index.php in RazorCMS 1.2.1 and earlier allows remote attackers to hijack the authentication of administrators for requests that delete arbitrary web pages via a showcats action...

PT-2012-5265

Name of the Vulnerable Software and Affected Versions jCore versions prior to 1.0pre2 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the path parameter in the "admin/index.php" endpoint. Recommendations For versions prior to 1.0pre2...

CVE-2012-4989: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/plugin-index.php in OpenX 2.8.10 before revision 81823 allows remote attackers to inject arbitrary web script or HTML via the parent parameter in an info action...

CVE-2012-4232: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/index.php in jCore before 1.0pre2 allows remote attackers to execute arbitrary SQL commands via the memberloginid cookie...

PT-2012-1312

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 2.6.9 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the PATH INFO to "index.php". Recommendations...

PT-2012-3638

Name of the Vulnerable Software and Affected Versions RazorCMS versions 1.2.1 and earlier Description A cross-site request forgery issue allows remote attackers to hijack administrator authentication for requests that delete arbitrary web pages via a showcats action in the admin/index.php file...

PT-2012-5266

Name of the Vulnerable Software and Affected Versions jCore versions prior to 1.0pre2 Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands. This is achieved by manipulating the memberloginid cookie in the admin/index.php file. Recommendations For versions...

PT-2012-2189

Name of the Vulnerable Software and Affected Versions Subrion CMS version 2.0.4 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the user name or password field in the admin/index.php file. Recommendations For Subrion CMS version 2.0.4,...

CVE-2011-5212: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/index.php in Subrion CMS 2.0.4 allows remote attackers to execute arbitrary SQL commands via the 1 user name or 2 password field...

CVE-2010-4821: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in phpMyFAQ before 2.6.9 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to index.php...

CVE-2012-4231: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/index.php in jCore before 1.0pre2 allows remote attackers to inject arbitrary web script or HTML via the path parameter...

PHP-eSeller SQL Injection Vulnerability

----- 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 + Site : 1337day.com 0 1 + Support e-mail :...

PT-2012-5967

Name of the Vulnerable Software and Affected Versions WebCalendar versions prior to 1.2.5 Description The issue allows remote attackers to modify settings.php and possibly execute arbitrary code via vectors related to the user theme preference in the install/index.php file. Recommendations For...

CVE-2012-5386: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in phpPaleo 4.8b180 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the phppaleo4lang cookie, a different vulnerability than CVE-2012-1671. NOTE: the provenance of this information is unknown; the details are...

CVE-2012-5385: Undefined Security Weakness

install/index.php in Craig Knudsen WebCalendar before 1.2.5 allows remote attackers to modify settings.php and possibly execute arbitrary code via vectors related to the user theme preference...

TinyCMS 1.4 Local File Inclusion

Exploit title: TinyCMS - Local File Inclusion + Date: 2/10/2012 + Author: Phizo + Vendor: http://www.tinycms.net/ + Version: 1.2 - 1.4 + Category: webapps + Google dork: intext:"Powered by TinyCMS" + Tested on: Windows 7 | Firefox 15.0.1 All current versions of TinyCMS seem to be affected by the...

Sql injection

SQL injection vulnerability in MangosWeb Enhanced 3.0.3 allows remote attackers to execute arbitrary SQL commands via the login parameter in a login action to index.php...

PT-2012-5943

Name of the Vulnerable Software and Affected Versions MangosWeb Enhanced version 3.0.3 Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands. This is achieved by manipulating the login parameter in a login action to the "index.php" endpoint. Recommendations F...