Uiga Personal Portal - Multiple Vulnerabilities

Uiga Personal Portal - Multiple Vulnerabilities Exploit Title: Uiga Personal Portal Multiple Vulnerability Date: 2011 Author: Eyup CELIK Version: All Version Tested on: All versions are Vulnerability Web Site: www.eyupcelik.com.tr ISSUE Blind SQL Injection and XSS can be done using the command...

Uiga Personal Portal Cross Site Scripting / Blind SQL Injection

Exploit Title: Uiga Personal Portal Multiple Vulnerability Date: 2011 Author: Eyup CELIK Version: All Version Tested on: All versions are Vulnerability Web Site: www.eyupcelik.com.tr ISSUE Blind SQL Injection and XSS can be done using the command input Vulnerable Page: index.php cart.php...

fims File Management System 1.2.1a - Multiple Vulnerabilities

fims File Management System 1.2.1a - Multiple Vulnerabilities Exploit Title: fims - File Management System execute"select from fimsuser where email='$email' and password=md5'$password'"; if $db-numrows$rs0 return true; else return false; Line 51 of index.php: if isset$REQUESTf...

Yet Another CMS 1.0 - SQL Injection / Cross-Site Scripting

Advisory: Yet Another CMS 1.0 SQL Injection & XSS vulnerabilities Advisory ID: SSCHADV2011-031 Author: Stefan Schurtz Affected Software: Successfully tested on Yet Another CMS 1.0 Vendor URL: http://yetanothercms.codeplex.com/ Vendor Status: informed ========================== Vulnerability...

Uiga Personal Portal Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Uiga Personal Portal Multiple Vulnerability Date: 2011 Author: Eyup CELIK Version: All Version Tested on: All versions are Vulnerability Web Site: www.eyupcelik.com.tr ISSUE Blind SQL Injection and XSS can be done using the...

Site@School 2.4.10 - index.php Cross-Site Scripting SQL Injection

Site@School 2.4.10 - index.php Cross-Site Scripting SQL Injection source: https://www.securityfocus.com/bid/50195/info Site@School is prone to multiple SQL-injection and cross-site scripting vulnerabilities. Exploiting these issues could allow an attacker to steal cookie-based authentication...

iSchoolSite SQL Injection

========================================================================== Exploit Title: iSchoolSite SQL Injection Vulnerability Date: 16.10.2011 Author: poach3r Software Link: http://www.ischoolsite.com/ Tested on: Windows XP SP3 Google Dork: "Powered by iSchoolSite" inurl:.php Price: $5000...

Multiple vulnerabilities in Efront

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Efront, which can be exploited to perform SQL injection and cross-site scripting attacks. 1 Cross-Site scripting XSS vulnerabilities in Efront 1.1 Input passed via the "course" GET parameter to index.php is not...

CVE-2010-4945

SQL injection vulnerability in the CamelcityDB comcamelcitydb2 component 2.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php...

Sql injection

SQL injection vulnerability in the Teams comteams component 110281008091711 for Joomla! allows remote attackers to execute arbitrary SQL commands via the PlayerID parameter in a player save action to index.php...

Sql injection

SQL injection vulnerability in the Slide Show comslideshow component for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter to index.php...

Sql injection

SQL injection vulnerability in the Joostina comezautos component for Joomla! allows remote attackers to execute arbitrary SQL commands via the firstCode parameter in a helpers action to index.php...

Sql injection

SQL injection vulnerability in index.php in WAnewsletter 2.1.2 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2010-4958

SQL injection vulnerability in index.php in Prado Portal 1.2.0 allows remote attackers to execute arbitrary SQL commands via the page parameter...

CVE-2010-4940

The CVE-2010-4940 entry concerns WAnewsletter 2.1.2, where a flaw in the script index.php enables SQL injection through the id parameter. This allows remote attackers to construct and execute arbitrary SQL commands, with potential partial confidentiality, integrity, and availability impacts as in...

CVE-2010-4930

Cross-site scripting XSS vulnerability in index.php in @mail Webmail before 6.2.0 allows remote attackers to inject arbitrary web script or HTML via the MailType parameter in a mail/auth/processlogin action...

CVE-2010-4939

CVE-2010-4939 is a PHP remote file inclusion vulnerability affecting MailForm 1.2 (index.php). The underlying issue is unsafe handling of the theme parameter, allowing an attacker to include a URL and execute arbitrary PHP code on the server. CVSS v2 base score is 7.5 (HIGH) with network access, ...

CVE-2010-4903

CVE-2010-4903 : CubeCart 4.3.3 contains a vulnerability in index.php where the searchStr parameter enables an SQL injection, allowing remote attackers to execute arbitrary SQL commands. The NVD entry lists a base score of 7.5 (HIGH) with network attack vector and low complexity, no authentication...

CVE-2010-4870

SQL injection vulnerability in index.php in BloofoxCMS 0.3.5 allows remote attackers to execute arbitrary SQL commands via the gender parameter...

CVE-2010-4870

BloofoxCMS 0.3.5 is vulnerable to an SQL injection in index.php via the gender parameter, allowing remote attackers to execute arbitrary SQL commands. This CVE (CVE-2010-4870) is backed by multiple sources (NVD entry and OpenVAS/PRION listings) that confirm the flaw and impact (high severity, CVS...