WordPress Finder Cross Site Scripting

Exploit Title: Wordpress Finder Cross Site Scripting Vulnerability Google Dork: inurl:wp-content/plugins/finder/ Date: 08/24/2012 Author: Crim3R Tested on: all $ $ ----Author will be not responsible for any damage---- $ ======================================== the order parametr is Vulnerable to...

Sql injection

Multiple SQL injection vulnerabilities in Kajian Website CMS Balitbang 3.x allow remote attackers to execute arbitrary SQL commands via the hal parameter to 1 the data module in alumni.php; or the 2 lihbuku, 3 artikel, 4 album, or 5 berita module in index.php...

CVE-2011-5112

SQL injection vulnerability in Alameda comalameda component before 1.0.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the storeid parameter to index.php...

CVE-2011-5103

SQL injection vulnerability in Alurian Prismotube PHP Video Script allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php...

CVE-2011-5115

DLGuard is affected by an XSS vulnerability (likely in version 4.6 and earlier) that can be triggered via the searchCart parameter to index.php. The root cause is insufficient input sanitization, allowing injection of arbitrary scripts/HTML. OpenVAS notes the vulnerability with a WillNotFix remed...

PT-2012-2093

Name of the Vulnerable Software and Affected Versions DLGuard versions 4.6 and earlier Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the searchCart parameter to "index.php". Recommendations For DLGuard versions 4.6 and earlier,...

PT-2012-2090

Name of the Vulnerable Software and Affected Versions com alameda component versions prior to 1.0.1 for Joomla! Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the storeid parameter to the "index.php" endpoint. Recommendations For versions pri...

CVE-2011-5112: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Alameda comalameda component before 1.0.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the storeid parameter to index.php...

CVE-2011-5115: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in DLGuard, possibly 4.6 and earlier, allows remote attackers to inject arbitrary web script or HTML via the searchCart parameter to index.php...

CVE-2011-5103: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Alurian Prismotube PHP Video Script allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php...

PT-2012-2089

Name of the Vulnerable Software and Affected Versions Kajian Website CMS Balitbang version 3.x Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the hal parameter to various modules, including the data module in alumni.php, and the lih buku,...

CVE-2011-5111: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Kajian Website CMS Balitbang 3.x allow remote attackers to execute arbitrary SQL commands via the hal parameter to 1 the data module in alumni.php; or the 2 lihbuku, 3 artikel, 4 album, or 5 berita module in index.php...

PT-2012-2081

Name of the Vulnerable Software and Affected Versions Alurian Prismotube PHP Video Script affected versions not specified Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the id parameter to the "index.php" endpoint. Recommendations At the...

1024cms 2.1.1 SQL Injection

Exploit Title: 1024cms 0 mysqlquery"UPDATE ".$prefix."online SET time='".$now."' WHERE ip='".$ip."'" or die"WHOSONLINE::: Cannot update user: ".mysqlerror; else mysqlquery"INSERT INTO ".$prefix."online time, ip, username, location, uid VALUES '".$now."', '".$ip."', '".$username."', '".$location."...

YourArcadeScript 2.4 - 'index.php?id' SQL Injection

Exploit Title: YourArcadeScript 2.4 SQLi Vulnerability Version: 2.4 Date: 17/08/2012 Author: DaOne LCA Software Link: http://www.yourarcadescript.com Google Dork: intext:"Powered by YourArcadeScript 2.4" Exploit http://localhost/index.php?act=cat&id=Error Based Injection thanks to : All LibyanCA...

CVE-2012-4324: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in PHPJabbers Vacation Rental Script allows remote attackers to hijack the authentication of administrators for requests that add administrator accounts via a create action in the AdminUsers module to index.php...

CVE-2012-3869

Cross-site scripting XSS vulnerability in include/classes/class.rexlist.inc.php in REDAXO 4.3.x and 4.4 allows remote attackers to inject arbitrary web script or HTML via the subpage parameter to index.php...

CVE-2012-3869

Cross-site scripting XSS vulnerability in include/classes/class.rexlist.inc.php in REDAXO 4.3.x and 4.4 allows remote attackers to inject arbitrary web script or HTML via the subpage parameter to index.php...

CVE-2012-3869

CVE-2012-3869 (Redaxo XSS) : A cross-site scripting vulnerability exists in Redaxo 4.3.x and 4.4 where input passed via the subpage parameter to index.php (when page is set to user or template) is not properly sanitized, allowing remote attackers to inject arbitrary HTML/JavaScript. Exploitation ...

CVE-2012-4251

The CVE-2012-4251 entry corresponds to multiple XSS vulnerabilities in MySQLDumper 1.24.4. Reported affected vectors include index.php (page param), install.php (phase param), sql.php (tablename or dbid params), and restore.php (filename param) within learn/cubemail/. The connected sources confir...