CVE-2014-8366

SQL injection vulnerability in openSIS 4.5 through 5.3 allows remote attackers to execute arbitrary SQL commands via the Username and password to index.php...

CVE-2012-5701

Multiple SQL injection vulnerabilities in dotProject before 2.1.7 allow remote authenticated administrators to execute arbitrary SQL commands via the 1 searchstring or 2 where parameter in a contacts action, 3 deptid parameter in a departments action, 4 projectid parameter in a project action, or...

CVE-2012-5701

Multiple SQL injection vulnerabilities in dotProject before 2.1.7 allow remote authenticated administrators to execute arbitrary SQL commands via the 1 searchstring or 2 where parameter in a contacts action, 3 deptid parameter in a departments action, 4 projectid parameter in a project action, or...

CVE-2014-6308

Directory traversal vulnerability in OSClass before 3.4.2 allows remote attackers to read arbitrary files via a .. dot dot in the file parameter in a render action to oc-admin/index.php...

CVE-2014-6280

Multiple cross-site scripting XSS vulnerabilities in OSClass before 3.4.2 allow remote attackers to inject arbitrary web script or HTML via the 1 action or 2 nsextt parameter to oc-admin/index.php or the 3 nsextt parameter in an itemsreported action to oc-admin/index.php...

CVE-2014-6308: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in OSClass before 3.4.2 allows remote attackers to read arbitrary files via a .. dot dot in the file parameter in a render action to oc-admin/index.php...

CVE-2014-8366: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in openSIS 4.5 through 5.3 allows remote attackers to execute arbitrary SQL commands via the Username and password to index.php...

CVE-2014-6280: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in OSClass before 3.4.2 allow remote attackers to inject arbitrary web script or HTML via the 1 action or 2 nsextt parameter to oc-admin/index.php or the 3 nsextt parameter in an itemsreported action to oc-admin/index.php...

PT-2014-6274

Name of the Vulnerable Software and Affected Versions Status2k affected versions not specified Description The issue allows remote attackers to obtain configuration information by sending a request to "status/index.php" with a phpinfo action, which invokes the phpinfo function. Recommendations At...

PT-2014-2360

Name of the Vulnerable Software and Affected Versions dotProject versions prior to 2.1.7 Description The issue allows remote authenticated administrators to execute arbitrary SQL commands. This can be achieved via several parameters in different actions to "index.php", including the search string...

PT-2014-8491

Name of the Vulnerable Software and Affected Versions openSIS versions 4.5 through 5.3 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the Username and password variables in the "index.php" endpoint. Recommendations For openSIS...

PT-2014-7129

Name of the Vulnerable Software and Affected Versions OSClass versions prior to 3.4.2 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the action or nsextt parameter to "oc-admin/index.php" or the nsextt parameter in an "items reported...

PT-2014-6388

Name of the Vulnerable Software and Affected Versions Pro Chat Rooms Text Chat Rooms version 8.2.0 Description The issue allows remote authenticated users to inject arbitrary web script or HTML, which can lead to cross-site scripting XSS attacks. This can be achieved via two methods: 1 uploading ...

CVE-2014-8307

Multiple cross-site scripting XSS vulnerabilities in skins/default/outline.tpl in C97net Cart Engine before 4.0 allow remote attackers to inject arbitrary web script or HTML via the 1 path parameter in the "drop down TOP menu with path" section or 2 printthispage variable in the footercontentbloc...

Open redirect

Open redirect vulnerability in the redir function in includes/function.php in C97net Cart Engine before 4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the HTTP Referer header to 1 index.php, 2 cart.php, 3 msg.php, or 4 page.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in skins/default/outline.tpl in C97net Cart Engine before 4.0 allow remote attackers to inject arbitrary web script or HTML via the 1 path parameter in the "drop down TOP menu with path" section or 2 printthispage variable in the footercontentbloc...

PT-2014-8454

Name of the Vulnerable Software and Affected Versions C97net Cart Engine versions prior to 4.0 Description The issue allows remote attackers to redirect users to arbitrary web sites, potentially leading to phishing attacks. This is achieved by manipulating the URL in the HTTP Referer header to...

CVE-2014-8304: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in In-Portal CMS 5.2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the nexttemplate parameter to admin/index.php...

PT-2014-8453

Name of the Vulnerable Software and Affected Versions In-Portal CMS versions 5.2.0 and earlier Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the next template parameter to "admin/index.php". Recommendations For In-Portal CMS versions...

客客专业威客系统程序xss漏洞

简要描述： 参数完全没控制. 之前有个selfxss不给我审核过.. 详细说明： /control/user/shopsetting.php $shopname, 'shopslogans' =$shopslogans, 'seotitle' =$seotitle, 'seokeyword' =$seokeyword, 'seodesc' =$seodesc, ; $intRes = $objShopT-save$arrData,array'shopid'=$shopInfo'shopid'; unset$objShopT;...