CVE-2012-6513: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php/AdminPreferences in gpEasy CMS 2.3.3 allows remote attackers to inject arbitrary web script or HTML via the jsoncallback parameter...

PT-2013-1977

Name of the Vulnerable Software and Affected Versions gpEasy CMS version 2.3.3 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the jsoncallback parameter in the index.php/Admin Preferences file. Recommendations For gpEasy C...

PT-2013-1980

Name of the Vulnerable Software and Affected Versions PHP Ticket System Beta 1 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the q parameter to the "index.php" endpoint. Recommendations For PHP Ticket System Beta 1, consider restricting acce...

PT-2013-1976

Name of the Vulnerable Software and Affected Versions Organizer plugin version 1.2.1 for WordPress Description The issue allows remote attackers to obtain the installation path via unspecified vectors to various PHP files, including "plugin hook.php", "page/index.php", "page/dir.php",...

CVE-2012-6519: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in modules/poll/index.php in DIY-CMS 1.0 allows remote attackers to execute arbitrary SQL commands via the start parameter to mod.php...

PT-2013-1978

Name of the Vulnerable Software and Affected Versions Joomla! component nBill com nbill version 2.3.2 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the message parameter in an income action to "administrator/index.php"...

PT-2013-1979

Name of the Vulnerable Software and Affected Versions eFront versions 3.6.10, 3.6.11 build 15059, and earlier Description The issue allows remote attackers to obtain sensitive information via an invalid courses ID parameter in the lesson info module to "index.php", which reveals the installation...

CVE-2012-6512: Exposure of Sensitive Information to an Unauthorized Actor

The Organizer plugin 1.2.1 for WordPress allows remote attackers to obtain the installation path via unspecified vectors to 1 pluginhook.php, 2 page/index.php, 3 page/dir.php 4 page/options.php, 5 page/resize.php, 6 page/upload.php, 7 page/users.php, or 8 page/view.php...

CVE-2012-6515: Exposure of Sensitive Information to an Unauthorized Actor

eFront 3.6.10, 3.6.11 build 15059, and earlier allows remote attackers to obtain sensitive information via invalid coursesID parameter in the lessoninfo module to index.php, which reveals the installation path in an error message...

CVE-2012-6516: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in PHP Ticket System Beta 1 allows remote attackers to execute arbitrary SQL commands via the q parameter to index.php...

Joomla Collector Shell Upload

Exploit Title:Joomla comcollecter shell upload Author: Red Dragonal Alb0zZ Team Home :HackForums.AL,alb0zz.in Date :19/01/2013 Category:: web apps Google dork: inurl:index.php?option=comcollector Tested on: Windows XP Download: http://www.steevo.fr/en/download Home Page: http://www.steevo.fr/...

WordPress Events Manager Plugin <= 5.3.4 - Multiple XSS

Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML via the "scope" parameter to index.php. Solution Update the plugin...

CVE-2012-5874

Multiple SQL injection vulnerabilities in the 1 updatewhosonlinereg and 2 updatewhosonlineguest functions in Elite Bulletin Board before 2.1.22 allow remote attackers to execute arbitrary SQL commands via the PATHINFO to a checkuser.php, b groups.php, c index.php, d login.php, e quicklogin.php, f...

PT-2013-1962

Name of the Vulnerable Software and Affected Versions Atomymaxsite versions 2.5 and earlier Description The issue allows remote attackers to execute arbitrary code by uploading a file with an executable extension to the index.php file, and then accessing it via a direct request to the file. This...

CVE-2012-6498: Undefined Security Weakness

Unrestricted file upload vulnerability in index.php in Atomymaxsite 2.5 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file, as exploited in the wild in October 2012...

CVE-2012-5666

Cross-site scripting XSS vulnerability in bookmarks/js/bookmarks.js in ownCloud 4.0.x before 4.0.10 and 4.5.x before 4.5.5 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to apps/bookmark/index.php...

CVE-2012-5666: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in bookmarks/js/bookmarks.js in ownCloud 4.0.x before 4.0.10 and 4.5.x before 4.5.5 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to apps/bookmark/index.php...

PT-2013-1832

Name of the Vulnerable Software and Affected Versions ownCloud versions 4.0.x through 4.0.9 ownCloud versions 4.5.x through 4.5.4 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the PATH INFO to "apps/bookmark/index.php"...

Invision Power Services Invision Gallery 1.0.1 Multiple SQL Injection Vulnerabilities

Exploit for php platform in category web applications source: http://www.securityfocus.com/bid/9944/info It has been reported that Invision Gallery may be prone to multiple sql injection vulnerabilities, allowing an attacker to influence SQL query logic. The issues exist due to insufficient...

CVE-2012-4932: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in SimpleInvoices before stable-2012-1-CIS3000 allow remote attackers to inject arbitrary web script or HTML via 1 the having parameter in a manage action to index.php; 2 the Email field in an Add User action; 3 the Customer Name field in an Add...