Directory traversal

Directory traversal vulnerability in index.php in phpPaleo 4.8b155 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the lang parameter...

Directory traversal

Directory traversal vulnerability in asaanCart 0.9 allows remote attackers to include arbitrary local files via a .. dot dot in the page parameter to index.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in asaanCart 0.9 allow remote attackers to inject arbitrary web script or HTML via the 1 PATHINFO to calc.php, 2 chat.php, 3 register.php, or 4 index.php in libs/smartyajax/; or the 5 page parameter to libs/smartyajax/index.php...

CVE-2012-5330

Multiple cross-site scripting XSS vulnerabilities in asaanCart 0.9 allow remote attackers to inject arbitrary web script or HTML via the 1 PATHINFO to calc.php, 2 chat.php, 3 register.php, or 4 index.php in libs/smartyajax/; or the 5 page parameter to libs/smartyajax/index.php...

CVE-2012-5330

Multiple cross-site scripting XSS vulnerabilities in asaanCart 0.9 allow remote attackers to inject arbitrary web script or HTML via the 1 PATHINFO to calc.php, 2 chat.php, 3 register.php, or 4 index.php in libs/smartyajax/; or the 5 page parameter to libs/smartyajax/index.php...

CVE-2012-5330

As provided, CVE-2012-5330 is an XSS vulnerability in asaanCart 0.9 affecting multiple entry points: the PATH_INFO parameters to calc.php, chat.php, register.php, or index.php in libs/smarty_ajax/, and the page parameter to libs/smarty_ajax/index.php. The description does not specify affected ver...

CVE-2012-5312

CVE-2012-5312 describes a SQL injection in Tribiq CMS. The affected component is the CMS (Tribiq CMS) and the vulnerability is triggered via the id parameter to index.php, allowing remote attackers to execute arbitrary SQL commands. The available sources explicitly state the vulnerability type an...

PT-2012-3431

Name of the Vulnerable Software and Affected Versions phpPaleo versions 4.8b155 and earlier Description The issue allows remote attackers to include and execute arbitrary local files via a .. dot dot in the lang parameter of the index.php file. This is a directory traversal vulnerability...

PT-2012-5911

Name of the Vulnerable Software and Affected Versions Tribiq CMS affected versions not specified Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the id parameter to the "index.php" endpoint. Recommendations At the moment, there is no informati...

CVE-2012-5312: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Tribiq CMS allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php...

CVE-2012-5331: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in asaanCart 0.9 allows remote attackers to include arbitrary local files via a .. dot dot in the page parameter to index.php...

CVE-2012-1671: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in phpPaleo 4.8b155 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the lang parameter...

Sql injection

Multiple SQL injection vulnerabilities in Plogger 1.0 RC1 allow remote attackers to execute arbitrary SQL commands via the id parameter to 1 index.php or 2 gallery.php...

Sql injection

Multiple SQL injection vulnerabilities in EasyWebRealEstate allow remote attackers to execute arbitrary SQL commands via the 1 lstid parameter to listings.php or 2 infoid parameter to index.php...

CVE-2012-5289: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Plogger 1.0 RC1 allow remote attackers to execute arbitrary SQL commands via the id parameter to 1 index.php or 2 gallery.php...

PT-2012-5889

Name of the Vulnerable Software and Affected Versions EasyWebRealEstate affected versions not specified Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the lstid parameter to "listings.php" or the infoid parameter to "index.php"...

PT-2012-5888

Name of the Vulnerable Software and Affected Versions Plogger version 1.0 RC1 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved by exploiting the id parameter in the API endpoints, specifically in "index.php" or "gallery.php". Recommendations Fo...

CVE-2012-5290: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in EasyWebRealEstate allow remote attackers to execute arbitrary SQL commands via the 1 lstid parameter to listings.php or 2 infoid parameter to index.php...

23rdweb Studio SQL Injection

---------------------------------------------------------------- 23rdweb Studio SQL Injection Vulnerability ---------------------------------------------------------------- Exploit Title : 23rdweb Studio SQL Injection Vulnerability Author : Hack Center Security Team Discovered By : Net.W0lf...

Handshakes Professional 4.1 SQL Injection

HTTPCS Advisory : HTTPCS70 Product : Handshakes Professional Version : 4.1 Date : 2012-10-01 Criticality level : Highly Critical Description : A vulnerability has been discovered in Handshakes Professional, which can be exploited by malicious people to conduct SQL injection attacks. Input passed...