CVE-2012-3869

Cross-site scripting XSS vulnerability in include/classes/class.rexlist.inc.php in REDAXO 4.3.x and 4.4 allows remote attackers to inject arbitrary web script or HTML via the subpage parameter to index.php...

CVE-2012-4251

The CVE-2012-4251 entry corresponds to multiple XSS vulnerabilities in MySQLDumper 1.24.4. Reported affected vectors include index.php (page param), install.php (phase param), sql.php (tablename or dbid params), and restore.php (filename param) within learn/cubemail/. The connected sources confir...

Hotel Booking Portal v0.1 Multiple Vulnerabilities

Exploit for php platform in category web applications ----------------------------------------------------------- / | | | | | | | | | | | | | | | | | / |/ |/ \ | | || | || | | | | / | ||\,|,||| ----------------------------------------------------------- Hotel Booking Portal v0.1 Multiple...

CVE-2012-4070

SQL injection vulnerability in system/src/dispatcher.php in Dir2web 3.0 allows remote attackers to execute arbitrary SQL commands via the oid parameter in a homepage action to index.php...

Sql injection

SQL injection vulnerability in system/src/dispatcher.php in Dir2web 3.0 allows remote attackers to execute arbitrary SQL commands via the oid parameter in a homepage action to index.php...

Sql injection

SQL injection vulnerability in admin/index.php in phpList before 2.10.19 allows remote administrators to execute arbitrary SQL commands via the delete parameter to the editattributes page...

CVE-2012-4034

Multiple SQL injection vulnerabilities in PBBoard 2.1.4 allow remote attackers to execute arbitrary SQL commands via the 1 username parameter to the send page, 2 email parameter to the forget page, 3 password parameter to the forumarchive page, 4 section parameter to the management page, 5...

CVE-2012-3952

CVE-2012-3952 is an XSS vulnerability in phpList 2.10.18 and earlier, occurring in admin/index.php when the unconfirmed parameter is used (page=user). Exploitation can cause arbitrary HTML/script execution in an administrator’s browser. The related advisory confirms a fixed vendor patch: upgrade ...

PT-2012-5160 · Pbboard · Pbboard

Name of the Vulnerable Software and Affected Versions: PBBoard version 2.1.4 Description: The issue allows remote attackers to change the password of arbitrary user accounts. This is achieved by exploiting the new password page, specifically through the member id and new password parameters to th...

HTTP header injection - ownCloud

A Header injection vulnerability in ownCloud before 4.0.8 allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content from the server via the HTTP url path parameter to index.php. Affected Software ownCloud Server 4.0.8 CVE-2012-5057 Action Taken It is...

Server: Multiple XSS vulnerabilities

Multiple cross-site scripting XSS vulnerabilities in ownCloud before 4.0.8 allow remote attackers to inject arbitrary web script or HTML via the readyCallback parameter to PUT.swf in apps/filesodfviewer/src/webodf/webodf/flashput/ the root parameter to index.php in apps/gallery/templates/ a...

Server: HTTP header injection

A Header injection vulnerability in ownCloud before 4.0.8 allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content from the server via the HTTP url path parameter to index.php. For more information please consult the official advisory. This advisory is...

phpcms v9 index.php本地任意文件包含漏洞

No description provided by source...

NetArt Media iBoutique 4.0 (index.php key parameter) SQL Injection Vulnerability

Exploit for php platform in category web applications Overview: --------- NetArt Media iBoutique SQL Injection Vulnerability. Technical Description: ---------------------- An SQL Injection Vulnerability is present in NetArt Media iBoutique as it fails to sanitise user-supplied input. Input passed...

CVE-2012-3350

The CVE-2012-3350 entry refers to a Blind SQL Injection in Webmatic 3.1.1 (vendor: valarsoft.com) via the Referer HTTP header fed to index.php. The underlying issue is improper sanitization of input used in SQL queries, enabling remote attackers to infer data (e.g., via time-based techniques) and...

Auth bypass in index.php - ownCloud

index.php before ownCloud 4.0.7 does not properly validate the octoken cookie, which allows remote attackers to bypass authentication via a crafted octoken cookie value. Affected Software ownCloud Server 4.0.7 CVE-2012-4392 Action Taken It is recommended that all instances are upgraded to ownClou...

Server: Auth bypass in index.php

index.php before ownCloud 4.0.7 does not properly validate the octoken cookie, which allows remote attackers to bypass authentication via a crafted octoken cookie value. For more information please consult the official advisory. This advisory is licensed CC BY-SA 4.0...

A Page Flip Book 2.3 - index.php pageflipbook_language Parameter Traversal Local File Inclusion

The A Page Flip Book WordPress plugin was affected by an index.php pageflipbooklanguage Parameter Traversal Local File Inclusion security vulnerability...

CVE-2012-3836

Multiple cross-site scripting XSS vulnerabilities in Baby Gekko before 1.2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 groupname parameter in a savecategory in the users module; 2 virtualfilename, 3 branch, 4 contactperson, 5 street, 6 city, 7 province, 8 postal, 9...

CVE-2012-3839

Multiple SQL injection vulnerabilities in application/core/MYModel.php in MyClientBase 0.12 allow remote attackers to execute arbitrary SQL commands via the 1 invoicenumber or 2 tags parameter to index.php/invoicesearch...