PT-2012-5406

Name of the Vulnerable Software and Affected Versions WordPress version 3.4.2 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that modify an RSS URL via a dashboard incoming links edit action. This occurs in t...

MediaWiki index.php 'uselang' Parameter XSS

The version of MediaWiki running on the remote host is affected by a cross-site scripting vulnerability due to a failure to properly sanitize user-supplied input to the 'uselang' parameter in the 'index.php' script. An attacker can exploit this to inject arbitrary HTML and script code into a user...

PT-2012-5811

Name of the Vulnerable Software and Affected Versions OSClass versions prior to 2.3.5 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the id parameter in a 1 edit category post or 2 enable category action to "index.php". Recommendations Fo...

PT-2012-5812

Name of the Vulnerable Software and Affected Versions OSClass versions prior to 2.3.5 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the id parameter in an enable category action to "index.php". Recommendations For versions prior to...

Sql injection

Multiple SQL injection vulnerabilities in OSClass before 2.3.5 allow remote attackers to execute arbitrary SQL commands via the sCategory parameter to index.php, which is not properly handled by the 1 oscsearchcategoryid function in oc-includes/osclass/helpers/hSearch.php and 2 findBySlug functio...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the getParam function in oc-includes/osclass/core/Params.php in OSClass before 2.3.5 allow remote attackers to inject arbitrary web script or HTML via the 1 sCity, 2 sPattern, 3 sPriceMax, and 4 sPriceMin parameters in a search action to...

CVE-2012-0973

Multiple SQL injection vulnerabilities in OSClass before 2.3.5 allow remote attackers to execute arbitrary SQL commands via the sCategory parameter to index.php, which is not properly handled by the 1 oscsearchcategoryid function in oc-includes/osclass/helpers/hSearch.php and 2 findBySlug functio...

CVE-2012-0974

Multiple cross-site scripting XSS vulnerabilities in the getParam function in oc-includes/osclass/core/Params.php in OSClass before 2.3.5 allow remote attackers to inject arbitrary web script or HTML via the 1 sCity, 2 sPattern, 3 sPriceMax, and 4 sPriceMin parameters in a search action to...

CVE-2012-0973

Multiple SQL injection vulnerabilities in OSClass before 2.3.5 allow remote attackers to execute arbitrary SQL commands via the sCategory parameter to index.php, which is not properly handled by the 1 oscsearchcategoryid function in oc-includes/osclass/helpers/hSearch.php and 2 findBySlug functio...

PT-2012-2979

Name of the Vulnerable Software and Affected Versions OSClass versions prior to 2.3.5 Description The issue allows remote attackers to execute arbitrary SQL commands. This is possible due to improper handling of the sCategory parameter to "index.php" by the 1 osc search category id function in...

PT-2012-2980

Name of the Vulnerable Software and Affected Versions OSClass versions prior to 2.3.5 Description The issue concerns multiple cross-site scripting XSS vulnerabilities in the getParam function. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via specific...

CVE-2012-0973: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in OSClass before 2.3.5 allow remote attackers to execute arbitrary SQL commands via the sCategory parameter to index.php, which is not properly handled by the 1 oscsearchcategoryid function in oc-includes/osclass/helpers/hSearch.php and 2 findBySlug functio...

CVE-2012-5105

CVE-2012-5105 affects SQLiteManager 1.2.4 and involves multiple cross-site scripting (XSS) vulnerabilities. Vulnerability details from connected sources show that remote attackers can inject arbitrary web script or HTML via the dbsel parameter to main.php or index.php, or via the nsextt parameter...

Ez Cart - SQL Injection Vulnerability

Exploit for php platform in category web applications 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 +...

PT-2012-2170

Name of the Vulnerable Software and Affected Versions Whois Search plugin version 1.4.2.3 Description The issue is a cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary web script or HTML via the domain parameter to "index.php" when the WHOIS widget is enabled...

CVE-2011-5193: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in vendors/samswhois/samswhois.inc.php in the Whois Search plugin 1.4.2.3 for WordPress, when the WHOIS widget is enabled, allows remote attackers to inject arbitrary web script or HTML via the domain parameter to index.php, a different vulnerability than...

PT-2012-5774

Name of the Vulnerable Software and Affected Versions SQLiteManager version 1.2.4 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the dbsel parameter to "main.php" or "index.php", or the nsextt parameter to "index.php". Recommendation...

CVE-2012-5105: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in SQLiteManager 1.2.4 allow remote attackers to inject arbitrary web script or HTML via the dbsel parameter to 1 main.php or 2 index.php; or 3 nsextt parameter to index.php...

CVE-2011-5190

Multiple cross-site scripting XSS vulnerabilities in Social Book Facebook Clone 2010 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO parameter to 1 signup.php, 2 lostpass.php, 3 login.php, 4 index.php, 5 helptos.php, 6 helpcontact.php, or 7 help.php...

Sql injection

Multiple SQL injection vulnerabilities in OrderSys 1.6.4 and earlier allow remote attackers to execute arbitrary SQL commands via the whereclause parameter to 1 index.php, 2 indexlong.php, or 3 indexshort.php in ordering/interfacecreator/...