PT-2014-2359

Name of the Vulnerable Software and Affected Versions Baby Gekko versions prior to 1.2.2f Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the id parameter to "admin/index.php", or the username or password parameters in...

CVE-2012-5700: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Baby Gekko before 1.2.2f allow remote attackers to inject arbitrary web script or HTML via the 1 id parameter to admin/index.php or the 2 username or 3 password parameter in blocks/loginbox/loginbox.template.php to index.php. NOTE: some of thes...

Joomla Spider Calendar <= 3.2.6 - SQL Injection

No description provided by source. !/usr/bin/env python -- coding:utf-8 -- from pocsuite.net import req from pocsuite.poc import Output, POCBase from pocsuite.utils import register class TestPOCPOCBase: vulID = '87242' version = '1' vulDate = '2014-08-31' author = 'anonymous' createDate =...

CVE-2014-4735

Cross-site scripting XSS vulnerability in MyWebSQL 3.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the table parameter to index.php...

Cross site scripting

Cross-site scripting XSS vulnerability in MyWebSQL 3.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the table parameter to index.php...

PT-2014-6082

Name of the Vulnerable Software and Affected Versions MyWebSQL versions 3.4 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML via the table parameter to "index.php". This is a cross-site scripting XSS issue. Recommendations For MyWebSQL versions 3.4...

CVE-2014-4735: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in MyWebSQL 3.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the table parameter to index.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Adiscon LogAnalyzer before 3.6.6 allow remote attackers to inject arbitrary web script or HTML via the hostname in 1 index.php or 2 detail.php...

CVE-2014-6070

Multiple cross-site scripting XSS vulnerabilities in Adiscon LogAnalyzer before 3.6.6 allow remote attackers to inject arbitrary web script or HTML via the hostname in 1 index.php or 2 detail.php...

CVE-2014-5519: Improper Control of Generation of Code

The Ploticus module in PhpWiki 1.5.0 allows remote attackers to execute arbitrary code via shell metacharacters in a device option in the editcontent parameter to index.php/HeIp. NOTE: some of these details are obtained from third party information...

PT-2014-7023

Name of the Vulnerable Software and Affected Versions LogAnalyzer versions prior to 3.6.6 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The injection can occur via the hostname...

CVE-2014-6070: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Adiscon LogAnalyzer before 3.6.6 allow remote attackers to inject arbitrary web script or HTML via the hostname in 1 index.php or 2 detail.php...

PT-2014-6505

Name of the Vulnerable Software and Affected Versions PhpWiki version 1.5.0 Description The issue allows remote attackers to execute arbitrary code via shell metacharacters in a device option in the editcontent parameter to "index.php/HeIp". Recommendations For PhpWiki version 1.5.0, avoid using...

CVE-2014-4929: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the routing component in ownCloud Server before 5.0.17 and 6.0.x before 6.0.4 allows remote attackers to include and execute arbitrary local files via a .. dot dot in a filename, related to index.php...

CVE-2014-5346: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the Disqus Comment System plugin 2.77 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 activate or 2 deactivate the plugin via the active parameter to wp-admin/edit-comments.php, 3...

PT-2014-6425

Name of the Vulnerable Software and Affected Versions Disqus Comment System plugin version 2.77 Description The issue affects the Disqus Comment System plugin, allowing remote attackers to hijack the authentication of administrators. This can be achieved through multiple cross-site request forger...

Sql injection

Multiple SQL injection vulnerabilities in ZPanel 10.0.1 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 resetkey or 2 inConfEmail parameter to index.php, a different vulnerability than CVE-2012-5685...

CVE-2012-6654

CVE-2012-6654 corresponds to multiple SQL injection vulnerabilities in ZPanel 10.0.1 and earlier, allowing remote attackers to execute arbitrary SQL commands via the (1) resetkey or (2) inConfEmail parameters to index.php. This vulnerability is explicitly stated as different from CVE-2012-5685. T...

PT-2014-2419

Name of the Vulnerable Software and Affected Versions ZPanel versions 10.0.1 and earlier Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the resetkey or inConfEmail parameter to the "index.php" endpoint. Recommendations For ZPanel versions...

CVE-2012-6654: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in ZPanel 10.0.1 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 resetkey or 2 inConfEmail parameter to index.php, a different vulnerability than CVE-2012-5685...