CVE-2015-4713: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in ApPHP Hotel Site 3.x.x allows remote editors to execute arbitrary SQL commands via the pid parameter to index.php...

PT-2015-6675

Name of the Vulnerable Software and Affected Versions ApPHP Hotel Site versions 3.x.x Description The issue allows remote editors to execute arbitrary SQL commands. This is achieved via the pid parameter to the "index.php" endpoint. Recommendations For ApPHP Hotel Site versions 3.x.x, avoid using...

CVE-2015-4656: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Synology Photo Station before 6.3-2945 allow remote attackers to inject arbitrary web script or HTML via the 1 success parameter to login.php or 2 crafted URL parameters to index.php, as demonstrated by the t parameter to photo/...

CVE-2015-4659: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in ClickHeat 1.14 and earlier allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via a config action to index.php...

PT-2015-6656

Name of the Vulnerable Software and Affected Versions Synology Photo Station versions prior to 6.3-2945 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the success parameter to "login.php" or crafted URL parameters to "index.php", suc...

PT-2015-6659

Name of the Vulnerable Software and Affected Versions ClickHeat versions 1.14 and earlier Description A cross-site request forgery issue allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via a config action to "index.php"...

PT-2015-5899

Name of the Vulnerable Software and Affected Versions Akronymmanager sb akronymmanager extension versions prior to 7.0.0 for TYPO3 Description The issue allows remote authenticated users with permission to maintain acronyms to execute arbitrary SQL commands. This is achieved via the id parameter ...

Projectsend r572 Cross Site Scripting

Title: Projectsend r572 - Cross Site Scripting Reflected Disclosed: 5/28/15 Vendor Patched: 6/6/15 Published: 6/10/15 Credit: Matt Landers - [email protected] Original Advisory: www.mjltech.net/adv/MJLTECH%20-%20Projectsend%20R572%20XSS.txt...

CVE-2015-2266

message/index.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 does not consider the moodle/site:readallmessages capability before accessing arbitrary conversations, which allows remote authenticated users to obtain sensitive personal-contact and...

CVE-2015-2266

message/index.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 does not consider the moodle/site:readallmessages capability before accessing arbitrary conversations, which allows remote authenticated users to obtain sensitive personal-contact and...

CVE-2015-2266: Exposure of Sensitive Information to an Unauthorized Actor

message/index.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 does not consider the moodle/site:readallmessages capability before accessing arbitrary conversations, which allows remote authenticated users to obtain sensitive personal-contact and...

CVE-2015-4127: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the churchadmin plugin before 0.810 for WordPress allows remote attackers to inject arbitrary web script or HTML via the address parameter, as demonstrated by a request to index.php/2015/05/21/churchadmin-registration-form/...

CVE-2012-4901

Template CMS (version 2.1.1 and earlier) is affected by a Cross‑Site Scripting (CWE-79) vulnerability in the themes_editor parameter passed to admin/index.php during add_template, enabling remote injection of arbitrary HTML/JS. Public advisories (HTB23115) describe the issue and note CSRF concern...

CVE-2012-4902: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in Template CMS 2.1.1 and earlier allow remote attackers to hijack the authentication of administrators for requests that 1 create an administrator user via an add action to admin/index.php or 2 conduct static PHP code injection attacks via...

CVE-2012-4901: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Template CMS 2.1.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the themeseditor parameter in an addtemplate action to admin/index.php...

PT-2015-3530

Name of the Vulnerable Software and Affected Versions Template CMS versions 2.1.1 and earlier Description The issue allows remote attackers to hijack the authentication of administrators for requests. This can be done in two ways: 1 by creating an administrator user via an "add" action to...

PT-2015-3529

Name of the Vulnerable Software and Affected Versions Template CMS versions 2.1.1 and earlier Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the themes editor parameter in an "add template" action to "admin/index.php". Recommendations F...

Fiyo-cms 2.018 /dapur/index.php SQL注入漏洞

漏洞链接： http://localhost/fiyo/dapur/index.php?app=user&act=edit&id=1sqli Parameter: id Type: UNION query Title: MySQL UNION query NULL - 10 columns Payload: app=user&act=edit&id=-1874 UNION ALL SELECT NULL,NULL,CONCAT0x7171676471,0x66457070464452786c58,0x716a767471,NULL,NULL,NULL,NULL,NULL,NULL,NUL...

FineCMS v2.3.5 /member/index.php SQL注入漏洞

No description provided by source...

CVE-2015-2250

Multiple cross-site scripting XSS vulnerabilities in concrete5 before 5.7.4 allow remote attackers to inject arbitrary web script or HTML via the 1 bannedword parameter to index.php/dashboard/system/conversations/bannedwords/success, 2 channel parameter to index.php/dashboard/reports/logs/view, 3...