PT-2012-3990

Name of the Vulnerable Software and Affected Versions WP-FaceThumb plugin version 0.1 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the pagination wp facethumb parameter in the...

CVE-2012-3869: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in include/classes/class.rexlist.inc.php in REDAXO 4.3.x and 4.4 allows remote attackers to inject arbitrary web script or HTML via the subpage parameter to index.php...

CVE-2012-2371: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in the WP-FaceThumb plugin 0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the paginationwpfacethumb parameter...

CVE-2012-4251: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in MySQLDumper 1.24.4 allow remote attackers to inject arbitrary web script or HTML via the 1 page parameter to index.php, 2 phase parameter to install.php, 3 tablename or 4 dbid parameter to sql.php, or 5 filename parameter to restore.php in...

PT-2012-5052

Name of the Vulnerable Software and Affected Versions REDAXO versions 4.3.x through 4.4 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML. This is achieved via the subpage parameter to the "index.php" endpoint. Recommendations For versions...

Hotel Booking Portal v0.1 Multiple Vulnerabilities

Exploit for php platform in category web applications ----------------------------------------------------------- / | | | | | | | | | | | | | | | | | / |/ |/ \ | | || | || | | | | / | ||\,|,||| ----------------------------------------------------------- Hotel Booking Portal v0.1 Multiple...

CVE-2012-4070

SQL injection vulnerability in system/src/dispatcher.php in Dir2web 3.0 allows remote attackers to execute arbitrary SQL commands via the oid parameter in a homepage action to index.php...

Sql injection

SQL injection vulnerability in system/src/dispatcher.php in Dir2web 3.0 allows remote attackers to execute arbitrary SQL commands via the oid parameter in a homepage action to index.php...

Sql injection

SQL injection vulnerability in admin/index.php in phpList before 2.10.19 allows remote administrators to execute arbitrary SQL commands via the delete parameter to the editattributes page...

PT-2012-5160 · Pbboard · Pbboard

Name of the Vulnerable Software and Affected Versions: PBBoard version 2.1.4 Description: The issue allows remote attackers to change the password of arbitrary user accounts. This is achieved by exploiting the new password page, specifically through the member id and new password parameters to th...

CVE-2012-4034

Multiple SQL injection vulnerabilities in PBBoard 2.1.4 allow remote attackers to execute arbitrary SQL commands via the 1 username parameter to the send page, 2 email parameter to the forget page, 3 password parameter to the forumarchive page, 4 section parameter to the management page, 5...

PT-2012-5083

Name of the Vulnerable Software and Affected Versions phplist versions prior to 2.10.19 Description The issue allows remote administrators to execute arbitrary SQL commands. This is achieved via the delete parameter to the 'editattributes' page in 'admin/index.php'. Recommendations For versions...

CVE-2012-4247: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote attackers to inject arbitrary web script or HTML via the 1 remoteuser, 2 remotedatabase, 3 remoteuserprefix, 4 remotepassword, or 5 remoteprefix parameter to the import4 page; or the ...

CVE-2012-4070: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in system/src/dispatcher.php in Dir2web 3.0 allows remote attackers to execute arbitrary SQL commands via the oid parameter in a homepage action to index.php...

CVE-2012-4035: Undefined Security Weakness

The newpassword page in PBBoard 2.1.4 allows remote attackers to change the password of arbitrary user accounts via the memberid and newpassword parameters to index.php...

CVE-2012-3952: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/index.php in phpList before 2.10.19 allows remote attackers to inject arbitrary web script or HTML via the unconfirmed parameter to the user page...

CVE-2012-3952

CVE-2012-3952 is an XSS vulnerability in phpList 2.10.18 and earlier, occurring in admin/index.php when the unconfirmed parameter is used (page=user). Exploitation can cause arbitrary HTML/script execution in an administrator’s browser. The related advisory confirms a fixed vendor patch: upgrade ...

CVE-2012-4246: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote attackers to inject arbitrary web script or HTML via the 1 page parameter; or the 2 footer, 3 status, or 4 testtarget parameter in the send page...

CVE-2012-3953: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/index.php in phpList before 2.10.19 allows remote administrators to execute arbitrary SQL commands via the delete parameter to the editattributes page...

PT-2012-5185

Name of the Vulnerable Software and Affected Versions Dir2web version 3.0 Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands. This is achieved by manipulating the oid parameter in a homepage action to the "index.php" endpoint. Recommendations For Dir2web...