13686 matches found
CVE-2012-5385: Undefined Security Weakness
install/index.php in Craig Knudsen WebCalendar before 1.2.5 allows remote attackers to modify settings.php and possibly execute arbitrary code via vectors related to the user theme preference...
CVE-2012-5386: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in index.php in phpPaleo 4.8b180 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the phppaleo4lang cookie, a different vulnerability than CVE-2012-1671. NOTE: the provenance of this information is unknown; the details are...
PT-2012-5967
Name of the Vulnerable Software and Affected Versions WebCalendar versions prior to 1.2.5 Description The issue allows remote attackers to modify settings.php and possibly execute arbitrary code via vectors related to the user theme preference in the install/index.php file. Recommendations For...
TinyCMS 1.4 Local File Inclusion
Exploit title: TinyCMS - Local File Inclusion + Date: 2/10/2012 + Author: Phizo + Vendor: http://www.tinycms.net/ + Version: 1.2 - 1.4 + Category: webapps + Google dork: intext:"Powered by TinyCMS" + Tested on: Windows 7 | Firefox 15.0.1 All current versions of TinyCMS seem to be affected by the...
Sql injection
SQL injection vulnerability in MangosWeb Enhanced 3.0.3 allows remote attackers to execute arbitrary SQL commands via the login parameter in a login action to index.php...
PT-2012-5943
Name of the Vulnerable Software and Affected Versions MangosWeb Enhanced version 3.0.3 Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands. This is achieved by manipulating the login parameter in a login action to the "index.php" endpoint. Recommendations F...
CVE-2012-5348: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in MangosWeb Enhanced 3.0.3 allows remote attackers to execute arbitrary SQL commands via the login parameter in a login action to index.php...
Directory traversal
Directory traversal vulnerability in index.php in phpPaleo 4.8b155 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the lang parameter...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in asaanCart 0.9 allow remote attackers to inject arbitrary web script or HTML via the 1 PATHINFO to calc.php, 2 chat.php, 3 register.php, or 4 index.php in libs/smartyajax/; or the 5 page parameter to libs/smartyajax/index.php...
CVE-2012-5330
Multiple cross-site scripting XSS vulnerabilities in asaanCart 0.9 allow remote attackers to inject arbitrary web script or HTML via the 1 PATHINFO to calc.php, 2 chat.php, 3 register.php, or 4 index.php in libs/smartyajax/; or the 5 page parameter to libs/smartyajax/index.php...
Directory traversal
Directory traversal vulnerability in asaanCart 0.9 allows remote attackers to include arbitrary local files via a .. dot dot in the page parameter to index.php...
CVE-2012-5330
As provided, CVE-2012-5330 is an XSS vulnerability in asaanCart 0.9 affecting multiple entry points: the PATH_INFO parameters to calc.php, chat.php, register.php, or index.php in libs/smarty_ajax/, and the page parameter to libs/smarty_ajax/index.php. The description does not specify affected ver...
CVE-2012-5330
Multiple cross-site scripting XSS vulnerabilities in asaanCart 0.9 allow remote attackers to inject arbitrary web script or HTML via the 1 PATHINFO to calc.php, 2 chat.php, 3 register.php, or 4 index.php in libs/smartyajax/; or the 5 page parameter to libs/smartyajax/index.php...
CVE-2012-5312
CVE-2012-5312 describes a SQL injection in Tribiq CMS. The affected component is the CMS (Tribiq CMS) and the vulnerability is triggered via the id parameter to index.php, allowing remote attackers to execute arbitrary SQL commands. The available sources explicitly state the vulnerability type an...
CVE-2012-5331: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in asaanCart 0.9 allows remote attackers to include arbitrary local files via a .. dot dot in the page parameter to index.php...
CVE-2012-5312: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in Tribiq CMS allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php...
PT-2012-3431
Name of the Vulnerable Software and Affected Versions phpPaleo versions 4.8b155 and earlier Description The issue allows remote attackers to include and execute arbitrary local files via a .. dot dot in the lang parameter of the index.php file. This is a directory traversal vulnerability...
CVE-2012-1671: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in index.php in phpPaleo 4.8b155 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the lang parameter...
PT-2012-5911
Name of the Vulnerable Software and Affected Versions Tribiq CMS affected versions not specified Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the id parameter to the "index.php" endpoint. Recommendations At the moment, there is no informati...