CVE-2011-5029

Multiple cross-site scripting XSS vulnerabilities in Simple PHP Blog 0.7.0 and possibly earlier allow remote attackers to inject arbitrary web script or HTML via the 1 entry parameter to delete.php or 2 category parameter to index.php...

PT-2011-5176

Name of the Vulnerable Software and Affected Versions Simple PHP Blog versions 0.7.0 and earlier Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. Specifically, the vulnerabilities...

CVE-2011-5029: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Simple PHP Blog 0.7.0 and possibly earlier allow remote attackers to inject arbitrary web script or HTML via the 1 entry parameter to delete.php or 2 category parameter to index.php...

CVE-2011-5026: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the addPost function in data/functions.php in Winn GuestBook before 2.4.8d allows remote attackers to inject arbitrary web script or HTML via the name parameter to index.php. NOTE: some of these details are obtained from third party information...

PT-2011-5173

Name of the Vulnerable Software and Affected Versions Winn GuestBook versions prior to 2.4.8d Description A cross-site scripting XSS issue exists in the addPost function, allowing remote attackers to inject arbitrary web script or HTML via the name parameter to "index.php". Recommendations For...

Unrestricted file upload

Unrestricted file upload vulnerability in QuiXplorer 2.3 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension using the upload action to index.php, then accessing it via a direct request to the file in an unspecified directory...

CVE-2011-5005: Undefined Security Weakness

Unrestricted file upload vulnerability in QuiXplorer 2.3 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension using the upload action to index.php, then accessing it via a direct request to the file in an unspecified directory...

PT-2011-5160

Name of the Vulnerable Software and Affected Versions QuiXplorer versions 2.3 and earlier Description The issue allows remote attackers to execute arbitrary code by uploading a file with an executable extension using the "upload action" to "index.php", then accessing it via a direct request to th...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Wuzly 2.0 allow remote attackers to inject arbitrary web script or HTML via the Referer header to 1 admin/login.php and 2 admin/404.php; the 3 q parameter to search.php; the 4 themename parameter to themesettings.php, 5 extensionname parameter ...

PT-2011-4721

Name of the Vulnerable Software and Affected Versions Wuzly version 2.0 Description A directory traversal issue exists, allowing remote attackers to read arbitrary files. This is achieved by using a .. dot dot in the preview parameter to "index.php". Recommendations For Wuzly version 2.0, avoid...

Artmedic Web Design Php Source Read

Exploit for php platform in category web applications Exploit Title: Artmedic Web Design Php Source Read Date: 23/12/2011 - 08:30 Author: Nafsh Site: Cyberwh.org Mail: email protected Software Website: http://www.artmedic.de/ Tested On: BackTrack 5 - Win7 Ultimate - Xp Platform: Php $ Dorks: "lin...

phpcms 9 index.php sql注入漏洞

No description provided by source...

Graphikodesign SQL Injection

Exploit Title: Graphikodesign Sql Injecti0n Vulnerability Date: 16/12/2011 - 14:08 Author: 3spi0n Software Website: http://www.graphikodesign.com/ Tested On: BackTrack 5 - Win7 Ultimate Platform: Php $ Dorks: "Powered by Graphikodesign" Vulnerable File : " index.php?go= " $ Demo Sites:...

PT-2011-5079

Name of the Vulnerable Software and Affected Versions Parallels Plesk Panel version 10.3.1 build1013110726.09 Description The issue concerns the billing system of Parallels Plesk Panel, where a password form field is generated without disabling the autocomplete feature. This makes it easier for...

CVE-2011-4745: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the billing system for Parallels Plesk Panel 10.3.1build1013110726.09 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by admin/index.php/default and certain other files...

CVE-2011-4749: Undefined Security Weakness

The billing system for Parallels Plesk Panel 10.3.1build1013110726.09 generates a password form field without disabling the autocomplete feature, which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation, as demonstrated by forms on certain pages...

PT-2011-5075

Name of the Vulnerable Software and Affected Versions Parallels Plesk Panel version 10.3.1 build1013110726.09 Description The issue concerns multiple cross-site scripting XSS vulnerabilities in the billing system. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML...

CVE-2011-4830

Multiple cross-site scripting XSS vulnerabilities in the comlisting component in Barter Sites component 1.3 for Joomla! allow remote authenticated users to inject arbitrary web script or HTML via the 1 listingtitle, 2 description, 3 homeurl aka Website Address, 4 paystring aka Payment types...

PT-2011-5130

Name of the Vulnerable Software and Affected Versions Barter Sites component version 1.3 for Joomla! Description The issue allows remote authenticated users to inject arbitrary web script or HTML via several parameters, including listing title, description, homeurl, paystring, sell price, shippin...

CVE-2011-4830: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the comlisting component in Barter Sites component 1.3 for Joomla! allow remote authenticated users to inject arbitrary web script or HTML via the 1 listingtitle, 2 description, 3 homeurl aka Website Address, 4 paystring aka Payment types...