PT-2012-2159 · WordPress +1 · Wordpress +1

Name of the Vulnerable Software and Affected Versions: Lanoba Social plugin version 1.0 Description: A cross-site scripting XSS issue in the Lanoba Social plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter in lanoba-social-plugin/index.php...

PT-2012-2160

Name of the Vulnerable Software and Affected Versions OrderSys versions 1.6.4 and earlier Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the where clause parameter to API endpoints such as "index.php", "index long.php", or "index short.php" i...

CVE-2011-5183: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in OrderSys 1.6.4 and earlier allow remote attackers to execute arbitrary SQL commands via the whereclause parameter to 1 index.php, 2 indexlong.php, or 3 indexshort.php in ordering/interfacecreator/...

CVE-2011-5190: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Social Book Facebook Clone 2010 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO parameter to 1 signup.php, 2 lostpass.php, 3 login.php, 4 index.php, 5 helptos.php, 6 helpcontact.php, or 7 help.php...

CVE-2011-5182: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in lanoba-social-plugin/index.php in the Lanoba Social plugin 1.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter. NOTE: the vendor disputes this issue, stating "Lanoba's plug in does sanitize user input,...

CVE-2012-4998

Cross-site scripting XSS vulnerability in index.php in starCMS allows remote attackers to inject arbitrary web script or HTML via the q parameter...

CVE-2012-4998

Cross-site scripting XSS vulnerability in index.php in starCMS allows remote attackers to inject arbitrary web script or HTML via the q parameter...

PT-2012-5718

Name of the Vulnerable Software and Affected Versions Witze addon version 0.9 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the id parameter in a "show" action within the jokes/index.php file. Recommendations For Witze addon versio...

PT-2012-5715

Name of the Vulnerable Software and Affected Versions AneCMS affected versions not specified Description The issue allows remote attackers to include and execute arbitrary local files via a .. dot dot in the p parameter in the "acp/index.php" endpoint. Recommendations At the moment, there is no...

CVE-2012-5000: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in jokes/index.php in the Witze addon 0.9 for deV!L'z Clanportal allows remote attackers to execute arbitrary SQL commands via the id parameter in a show action...

CVE-2012-4997: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in acp/index.php in AneCMS allows remote attackers to include and execute arbitrary local files via a .. dot dot in the p parameter...

CVE-2012-4998: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in starCMS allows remote attackers to inject arbitrary web script or HTML via the q parameter...

PT-2012-5716

Name of the Vulnerable Software and Affected Versions starCMS affected versions not specified Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the q parameter in the "index.php" file...

CVE-2012-1901: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in FlexCMS 3.2.1 and earlier allow remote attackers to 1 hijack the authentication of users for requests that change account settings via a request to index.php/profile-edit-save or 2 hijack the authentication of administrators for requests...

PT-2012-3639

Name of the Vulnerable Software and Affected Versions FlexCMS versions 3.2.1 and earlier Description The issue allows remote attackers to hijack user authentication for requests that change account settings via a request to "index.php/profile-edit-save" or hijack administrator authentication for...

LogAnalyzer index.php 'filter' Parameter XSS

The LogAnalyzer install hosted on the remote web server is affected by a cross-site scripting vulnerability due to a failure to properly sanitize user input to the 'filter' parameter of the 'index.php' script. An attacker can exploit this issue to inject arbitrary HTML and script code into a user...

LogAnalyzer index.php 'highlight' Parameter XSS

The LogAnalyzer install hosted on the remote web server is affected by a cross-site scripting vulnerability due to a failure to properly sanitize user input to the 'highlight' parameter of the 'index.php' script. An attacker can exploit this issue to inject arbitrary HTML and script code into a...

CVE-2012-4336

Multiple cross-site scripting XSS vulnerabilities in index.php in Flogr 2.5.6 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the PATHINFO or 2 an arbitrary parameter...

Sql injection

SQL injection vulnerability in Limesurvey a.k.a PHPSurveyor before 1.91+ Build 120224 and earlier allows remote attackers to execute arbitrary SQL commands via the fieldnames parameter to index.php...

CVE-2012-4927

SQL injection vulnerability in Limesurvey a.k.a PHPSurveyor before 1.91+ Build 120224 and earlier allows remote attackers to execute arbitrary SQL commands via the fieldnames parameter to index.php...