CVE-2014-8506: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Etiko CMS allow remote attackers to execute arbitrary SQL commands via the 1 pageid parameter to loja/index.php or 2 articleid parameter to index.php...

PT-2014-8569

Name of the Vulnerable Software and Affected Versions Etiko CMS affected versions not specified Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the page id parameter to "loja/index.php" or the article id parameter to "index.php"...

PT-2014-8568

Name of the Vulnerable Software and Affected Versions Etiko CMS affected versions not specified Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. Specifically, the vulnerabilities...

CVE-2014-8505: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Etiko CMS allow remote attackers to inject arbitrary web script or HTML via the 1 pageid parameter to loja/index.php or 2 articleid parameter to index.php...

Incredible PBX 2.0.6.5.0 - Remote Command Execution

Incredible PBX 2.0.6.5.0 - Remote Command Execution !/usr/bin/perl Title: Incredible PBX remote command execution exploit Author: Simo Ben youssef Contact: SimoatMorxploitcom Discovered: 1 September 2014 Coded: 21 October 2014 Published: 21 October 2014 MorXploit Research http://www.MorXploit.com...

CVE-2014-6635

CVE-2014-6635 affects Exponent CMS 2.3.0, exposing a cross-site scripting (XSS) flaw in the src parameter of the search action to index.php. The vulnerability allows remote attackers to inject arbitrary web script or HTML. CVSS v2 base score is 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N). Exploitation statu...

CVE-2014-6635

Cross-site scripting XSS vulnerability in Exponent CMS 2.3.0 allows remote attackers to inject arbitrary web script or HTML via the src parameter in the search action to index.php...

CVE-2013-1641

Directory traversal vulnerability in the zip download functionality in QuiXplorer before 2.5.5 allows remote attackers to read arbitrary files via a .. dot dot in the selitems parameter in a downloadselected action to index.php...

CVE-2014-6635: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Exponent CMS 2.3.0 allows remote attackers to inject arbitrary web script or HTML via the src parameter in the search action to index.php...

PT-2014-7314

Name of the Vulnerable Software and Affected Versions Exponent CMS version 2.3.0 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the src parameter in the "search" action to "index.php". Recommendations For Exponent CMS version 2.3.0,...

CVE-2013-1641: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the zip download functionality in QuiXplorer before 2.5.5 allows remote attackers to read arbitrary files via a .. dot dot in the selitems parameter in a downloadselected action to index.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in dotProject before 2.1.7 allow remote attackers to inject arbitrary web script or HTML via the 1 callback parameter in a colorselector action, 2 field parameter in a dateformat action, or 3 companyname parameter in an addedit action to index.php...

PT-2014-2361

Name of the Vulnerable Software and Affected Versions dotProject versions prior to 2.1.7 Description The issue allows remote attackers to inject arbitrary web script or HTML via specific parameters in actions to index.php, including the callback parameter in a color selector action, the field...

CVE-2012-5702: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in dotProject before 2.1.7 allow remote attackers to inject arbitrary web script or HTML via the 1 callback parameter in a colorselector action, 2 field parameter in a dateformat action, or 3 companyname parameter in an addedit action to index.php...

CVE-2014-8377: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Webasyst Shop-Script 5.2.2.30933 allows remote attackers to inject arbitrary web script or HTML via the phone number field in a new contact to phpecom/index.php/webasyst/contacts/...

PT-2014-8500

Name of the Vulnerable Software and Affected Versions Webasyst Shop-Script version 5.2.2.30933 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the phone number field in a new contact to "phpecom/index.php/webasyst/contacts/"...

Incredible PBX 11 2.0.6.5.0 Remote Command Execution

!/usr/bin/perl Title: Incredible PBX remote command execution exploit Author: Simo Ben youssef Contact: SimoatMorxploitcom Discovered: 1 September 2014 Coded: 21 October 2014 Published: 21 October 2014 MorXploit Research http://www.MorXploit.com Vendor: PBX in a Flash Vendor url:...

Sql injection

SQL injection vulnerability in openSIS 4.5 through 5.3 allows remote attackers to execute arbitrary SQL commands via the Username and password to index.php...

CVE-2014-8366

SQL injection vulnerability in openSIS 4.5 through 5.3 allows remote attackers to execute arbitrary SQL commands via the Username and password to index.php...

CVE-2012-5701

Multiple SQL injection vulnerabilities in dotProject before 2.1.7 allow remote authenticated administrators to execute arbitrary SQL commands via the 1 searchstring or 2 where parameter in a contacts action, 3 deptid parameter in a departments action, 4 projectid parameter in a project action, or...