CVE-2012-0997

Cross-site request forgery CSRF vulnerability in admin/index.php in 11in1 1.2.1 stable 12-31-2011 allows remote attackers to hijack the authentication of administrators for requests that add new topics via an addTopic action...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in admin/index.php in 11in1 1.2.1 stable 12-31-2011 allows remote attackers to hijack the authentication of administrators for requests that add new topics via an addTopic action...

Sql injection

SQL injection vulnerability in CONTIMEX Impulsio CMS allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php...

CVE-2012-1294

SQL injection vulnerability in CONTIMEX Impulsio CMS allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php...

CVE-2012-1294: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in CONTIMEX Impulsio CMS allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php...

PT-2012-3182

Name of the Vulnerable Software and Affected Versions CONTIMEX Impulsio CMS affected versions not specified Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the id parameter in the "index.php" endpoint. Recommendations At...

PT-2012-3173

Name of the Vulnerable Software and Affected Versions EasyVista versions prior to 2010.1.1.89 Description The issue concerns the single sign-on SSO implementation, which allows remote attackers to bypass authentication. This can be achieved by modifying the url account parameter in conjunction wi...

P-Chat 0.9 Cross Site Scripting

Exploit Title: P-Chat v0.9 XSS Vulnerability Date: 2012 Author: Eyup CELIK Version: All Version Tested on: All versions are Vulnerability Web Site: www.eyupcelik.com.tr ISSUE Cross Site Scripting can be done using the command input Vulnerable Page: index.php XSS Example: "/ XSS Code POC:...

CVE-2012-0997

Cross-site request forgery CSRF vulnerability in admin/index.php in 11in1 1.2.1 stable 12-31-2011 allows remote attackers to hijack the authentication of administrators for requests that add new topics via an addTopic action...

CVE-2012-0997

CVE-2012-0997: CSRF vulnerability in 11in1 1.2.1 stable (12-31-2011) affecting admin/index.php, allowing an attacker to hijack administrator authentication to perform addTopic requests. Multiple connected sources corroborate CSRF context and impact (topic creation via addTopic) with PoC examples ...

PT-2012-3135

Name of the Vulnerable Software and Affected Versions Semantic Enterprise Wiki SMW+ versions 1.5.6, 1.6.0 2 and earlier Description The issue is related to a cross-site scripting XSS vulnerability in the smwfOnSfSetTargetName function. This vulnerability allows remote attackers to inject arbitrar...

CVE-2012-0996: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in 11in1 1.2.1 stable 12-31-2011 allow remote attackers to read arbitrary files via a .. dot dot in the class parameter to 1 index.php or 2 admin/index.php...

CVE-2012-0997: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in admin/index.php in 11in1 1.2.1 stable 12-31-2011 allows remote attackers to hijack the authentication of administrators for requests that add new topics via an addTopic action...

CVE-2012-1212: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the smwfOnSfSetTargetName function in extensions/SMWHalo/includes/SMWInitialize.php in Semantic Enterprise Wiki SMW+ 1.5.6, 1.6.02 and earlier allows remote attackers to inject arbitrary web script or HTML via the target parameter to...

PT-2012-3002

Name of the Vulnerable Software and Affected Versions 11in1 version 1.2.1 Description A cross-site request forgery issue allows remote attackers to hijack the authentication of administrators for requests that add new topics via an "addTopic" action. Recommendations For version 1.2.1, as a...

PT-2012-3001

Name of the Vulnerable Software and Affected Versions 11in1 version 1.2.1 Description The issue allows remote attackers to read arbitrary files due to multiple directory traversal vulnerabilities. This can be achieved by including a .. dot dot in the class parameter to API endpoints such as...

CVE-2012-1200: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Nova CMS allow remote attackers to execute arbitrary PHP code via a URL in the 1 fileType parameter to optimizer/index.php, 2 id parameter to administrator/modules/moduleslist.php, 3 filename parameter to includes/function/gets.php, or 4...

Webgrind 1.0 Cross Site Scripting

webgrind 1.0 dataFile Remote Reflected XSS Vulnerability Vendor: Joakim Nygard and Jacob Oettinger Product web page: http://code.google.com/p/webgrind Affected version: 1.0 Summary: Webgrind is an Xdebug profiling web frontend in PHP5. Desc: webgrind suffers from a XSS vulnerability when parsing...

WampServer 2.2c Cross Site Scripting

WampServer = 2.2c lang Remote Cross-Site Scripting Vulnerability Vendor: Alter Way Product web page: http://www.wampserver.com Affected version: = 2.2c 32/64bit Summary: WampServer is a Windows web development environment. It allows you to create web applications with Apache2, PHP and a MySQL...

Sql injection

SQL injection vulnerability in the WP-RecentComments plugin 2.0.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter in an rc-content action to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third part...