PT-2012-5840

Name of the Vulnerable Software and Affected Versions phplist versions prior to 2.10.19 Description The issue allows remote attackers to inject arbitrary web script or HTML via the testtarget parameter in the "admin/index.php" page, potentially leading to cross-site scripting XSS attacks...

CVE-2012-1604: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in NextBBS 0.6 allows remote attackers to inject arbitrary web script or HTML via the do parameter to index.php...

PT-2012-3374

Name of the Vulnerable Software and Affected Versions NextBBS version 0.6 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML. This is achieved by manipulating the do parameter to index.php. Recommendations For NextBBS version 0.6, update to...

Poweradmin index.php XSS

The Poweradmin install hosted on the remote web server is affected by a cross-site scripting vulnerability because it fails to properly sanitize user input appended to the URL of the 'index.php' script. An attacker may be able to leverage this to inject arbitrary HTML and script code into a user'...

FvS Groupmp3 CMS SQL Injection

Exploit Title: FvS Groupmp3 cms Sql Injection Google Dork: inurl:/index.php?adi=mp3 Date: 09/28/2012 Author: Crim3R Vendor Home: Version: - Tested on: Linux Redhat ===============Vuln Codes============= adi parametr in index.php is injectable D3M0 :...

CVE-2012-4448

Cross-site request forgery CSRF vulnerability in wp-admin/index.php in WordPress 3.4.2 allows remote attackers to hijack the authentication of administrators for requests that modify an RSS URL via a dashboardincominglinks edit action...

PT-2012-5406

Name of the Vulnerable Software and Affected Versions WordPress version 3.4.2 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that modify an RSS URL via a dashboard incoming links edit action. This occurs in t...

CVE-2012-4448: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in wp-admin/index.php in WordPress 3.4.2 allows remote attackers to hijack the authentication of administrators for requests that modify an RSS URL via a dashboardincominglinks edit action...

MediaWiki index.php 'uselang' Parameter XSS

The version of MediaWiki running on the remote host is affected by a cross-site scripting vulnerability due to a failure to properly sanitize user-supplied input to the 'uselang' parameter in the 'index.php' script. An attacker can exploit this to inject arbitrary HTML and script code into a user...

PT-2012-5811

Name of the Vulnerable Software and Affected Versions OSClass versions prior to 2.3.5 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the id parameter in a 1 edit category post or 2 enable category action to "index.php". Recommendations Fo...

PT-2012-5812

Name of the Vulnerable Software and Affected Versions OSClass versions prior to 2.3.5 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the id parameter in an enable category action to "index.php". Recommendations For versions prior to...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the getParam function in oc-includes/osclass/core/Params.php in OSClass before 2.3.5 allow remote attackers to inject arbitrary web script or HTML via the 1 sCity, 2 sPattern, 3 sPriceMax, and 4 sPriceMin parameters in a search action to...

Sql injection

Multiple SQL injection vulnerabilities in OSClass before 2.3.5 allow remote attackers to execute arbitrary SQL commands via the sCategory parameter to index.php, which is not properly handled by the 1 oscsearchcategoryid function in oc-includes/osclass/helpers/hSearch.php and 2 findBySlug functio...

CVE-2012-0974

Multiple cross-site scripting XSS vulnerabilities in the getParam function in oc-includes/osclass/core/Params.php in OSClass before 2.3.5 allow remote attackers to inject arbitrary web script or HTML via the 1 sCity, 2 sPattern, 3 sPriceMax, and 4 sPriceMin parameters in a search action to...

CVE-2012-0973

Multiple SQL injection vulnerabilities in OSClass before 2.3.5 allow remote attackers to execute arbitrary SQL commands via the sCategory parameter to index.php, which is not properly handled by the 1 oscsearchcategoryid function in oc-includes/osclass/helpers/hSearch.php and 2 findBySlug functio...

CVE-2012-0973

Multiple SQL injection vulnerabilities in OSClass before 2.3.5 allow remote attackers to execute arbitrary SQL commands via the sCategory parameter to index.php, which is not properly handled by the 1 oscsearchcategoryid function in oc-includes/osclass/helpers/hSearch.php and 2 findBySlug functio...

CVE-2012-0973: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in OSClass before 2.3.5 allow remote attackers to execute arbitrary SQL commands via the sCategory parameter to index.php, which is not properly handled by the 1 oscsearchcategoryid function in oc-includes/osclass/helpers/hSearch.php and 2 findBySlug functio...

PT-2012-2979

Name of the Vulnerable Software and Affected Versions OSClass versions prior to 2.3.5 Description The issue allows remote attackers to execute arbitrary SQL commands. This is possible due to improper handling of the sCategory parameter to "index.php" by the 1 osc search category id function in...

PT-2012-2980

Name of the Vulnerable Software and Affected Versions OSClass versions prior to 2.3.5 Description The issue concerns multiple cross-site scripting XSS vulnerabilities in the getParam function. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via specific...

CVE-2012-5105

CVE-2012-5105 affects SQLiteManager 1.2.4 and involves multiple cross-site scripting (XSS) vulnerabilities. Vulnerability details from connected sources show that remote attackers can inject arbitrary web script or HTML via the dbsel parameter to main.php or index.php, or via the nsextt parameter...