13397 matches found
CVE-2011-0745
SugarCRM before 6.1.3 does not properly handle reloads and direct requests for a warning page produced by a certain duplicate check, which allows remote authenticated users to discover 1 the names of customers via a ShowDuplicates action to the Accounts module, reachable through index.php; or 2 t...
PT-2011-2604
Name of the Vulnerable Software and Affected Versions SugarCRM versions prior to 6.1.3 Description The issue allows remote authenticated users to discover sensitive information, including the names of customers and contact persons, by exploiting a flaw in how the software handles reloads and dire...
Maian Weblog 4.0 - Blind SQL Injection
Maian Weblog 4.0 - Blind SQL Injection ?php / maian weblog = v4.0 Remote Blind SQL Injection Exploit vendor: http://www.maianscriptworld.co.uk/ Thanks to Johannes Dahse: http://bit.ly/dpQXMK Explanation: Lines 335 - 341 of the index.php we see this if statement that concerns our variable $bpost. ...
'Quick Polls' Local File Inclusion & Deletion Vulnerabilities (CVE-2011-1099)
'Quick Polls' Local File Inclusion & Deletion Vulnerabilities CVE-2011-1099 Mark Stanislav - [email protected] I. DESCRIPTION --------------------------------------- Two vulnerabilities exist in 'Quick Polls' providing local file inclusion & local file deletion due to null-byte attacks...
Quick Polls 1.0.1 Local File Inclusion / Deletion
'Quick Polls' Local File Inclusion & Deletion Vulnerabilities CVE-2011-1099 Mark Stanislav - [email protected] I. DESCRIPTION --------------------------------------- Two vulnerabilities exist in 'Quick Polls' providing local file inclusion & local file deletion due to null-byte attacks...
Quick Polls - Local File Inclusion Deletion
Quick Polls - Local File Inclusion Deletion 'Quick Polls' Local File Inclusion & Deletion Vulnerabilities CVE-2011-1099 Mark Stanislav - [email protected] I. DESCRIPTION --------------------------------------- Two vulnerabilities exist in 'Quick Polls' providing local file inclusion & loca...
Bo-blog v2.1.1 注入漏洞
inc/modmain.php //漏洞文件： case 'category': if !$job $job='default'; else $job=basename$job; $ifannouncement="none"; acceptrequest'mode'; if $mode==1 || $mode==2 //.......................... elseif !empty$mode && !isnumeric$mode || $mode2 getHttp404$lnc313; //...................... if isnumeric$item...
VidiScript Cross Site Scripting
Exploit Title: VidiScript index.php Cross Site Scripting home : http://www.D99Y.com Author: NassRawI Date: 2/3/2011 Google Dork: "Powered By VidiScript.com" Software Link: http://www.vidiscript.com/ file : index.php exploit : http://localhost/index.php?vp= XSS...
CubeCart 2.0.6 Cross Site Scripting / SQL Injection
Exploit Title: CubeCart 2.0.6 SQL injection / Cross Site Scripting Google Dork: "Powered by CubeCart 2.0.6" home : http://www.D99Y.com Date: 2/3/2011 Author: NassRawI Software Link: http://www.cubecart.com Version: 2.0.6 1 SQL injection file : index.php exploit : http://localhost/index.php?catid=...
CVE-2010-4749: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in BLOG:CMS 4.2.1.e, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the 1 body parameter to action.php and the 2 amount and 3 action parameters to admin/index.php...
PT-2011-1699
Name of the Vulnerable Software and Affected Versions BLOG:CMS versions 4.2.1.e and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the body parameter to "action.php" and the amount and action parameters to "admin/index.php"...
Sql injection
Multiple SQL injection vulnerabilities in admin/index.php in Pixelpost 1.7.3 allow remote authenticated users to execute arbitrary SQL commands via the 1 findfid, 2 id, 3 selectfcat, 4 selectfmon, or 5 selectftag parameter in an images action...
CVE-2011-1100
Multiple SQL injection vulnerabilities in admin/index.php in Pixelpost 1.7.3 allow remote authenticated users to execute arbitrary SQL commands via the 1 findfid, 2 id, 3 selectfcat, 4 selectfmon, or 5 selectftag parameter in an images action...
PT-2011-2865
Name of the Vulnerable Software and Affected Versions Pixelpost version 1.7.3 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved through SQL injection vulnerabilities in the admin/index.php file, specifically via the findfid, id, selectfcat...
CVE-2011-1100: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL injection vulnerabilities in admin/index.php in Pixelpost 1.7.3 allow remote authenticated users to execute arbitrary SQL commands via the 1 findfid, 2 id, 3 selectfcat, 4 selectfmon, or 5 selectftag parameter in an images action...
WordPress Forum Server Plugin 1.6.5 - SQL Injection
WordPress Forum Server plugin is prone to an SQL injection. This vulnerability exists because of failure in the "index.php" script to properly clean up user-supplied input in "searchmax" variable and in the "/wp-content/plugins/forum-server/feed.php" script to properly sanitize user-supplied inpu...
CVE-2011-1062
Multiple cross-site scripting XSS vulnerabilities in include/html/header.php in TaskFreak! 0.6.4 allow remote attackers to inject arbitrary web script or HTML via the 1 sContext, 2 sort, 3 dir, and 4 show parameters in a save action to index.php; the 5 dir and 6 show parameters to printlist.php;...
Hyena Cart SQL Injection
Hyena Cart index.php Sql Injection Vulnerability ==================================================================== .:. Author : AtT4CKxT3rR0r1ST [email protected] .:. Script : http://hyenacart.com/ .:. Dork : "This store is powered by Hyena Cart" .:. Home : http://www.sec-risk.com/vb/ === Exploit ==...
Hyena Cart - index.php SQL Injection
Hyena Cart - index.php SQL Injection Hyena Cart index.php Sql Injection Vulnerability ==================================================================== .:. Author : AtT4CKxT3rR0r1ST [email protected] .:. Script : http://hyenacart.com/ .:. Dork : "This store is powered by Hyena Cart" .:. Home :...
