13686 matches found
PT-2012-5715
Name of the Vulnerable Software and Affected Versions AneCMS affected versions not specified Description The issue allows remote attackers to include and execute arbitrary local files via a .. dot dot in the p parameter in the "acp/index.php" endpoint. Recommendations At the moment, there is no...
PT-2012-3639
Name of the Vulnerable Software and Affected Versions FlexCMS versions 3.2.1 and earlier Description The issue allows remote attackers to hijack user authentication for requests that change account settings via a request to "index.php/profile-edit-save" or hijack administrator authentication for...
CVE-2012-1901: Cross-Site Request Forgery (CSRF)
Multiple cross-site request forgery CSRF vulnerabilities in FlexCMS 3.2.1 and earlier allow remote attackers to 1 hijack the authentication of users for requests that change account settings via a request to index.php/profile-edit-save or 2 hijack the authentication of administrators for requests...
LogAnalyzer index.php 'filter' Parameter XSS
The LogAnalyzer install hosted on the remote web server is affected by a cross-site scripting vulnerability due to a failure to properly sanitize user input to the 'filter' parameter of the 'index.php' script. An attacker can exploit this issue to inject arbitrary HTML and script code into a user...
LogAnalyzer index.php 'highlight' Parameter XSS
The LogAnalyzer install hosted on the remote web server is affected by a cross-site scripting vulnerability due to a failure to properly sanitize user input to the 'highlight' parameter of the 'index.php' script. An attacker can exploit this issue to inject arbitrary HTML and script code into a...
CVE-2012-4336
Multiple cross-site scripting XSS vulnerabilities in index.php in Flogr 2.5.6 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the PATHINFO or 2 an arbitrary parameter...
Sql injection
SQL injection vulnerability in Limesurvey a.k.a PHPSurveyor before 1.91+ Build 120224 and earlier allows remote attackers to execute arbitrary SQL commands via the fieldnames parameter to index.php...
CVE-2012-4927
SQL injection vulnerability in Limesurvey a.k.a PHPSurveyor before 1.91+ Build 120224 and earlier allows remote attackers to execute arbitrary SQL commands via the fieldnames parameter to index.php...
CVE-2012-4928
The vulnerability is an XSS in Oxwall 1.1.1, specifically in the file ow_updates/index.php . It allows remote attackers to inject arbitrary web script or HTML through the plugin parameter. The issue arises from improper handling of user-supplied input in this script, leading to potential script e...
CVE-2012-4336: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in index.php in Flogr 2.5.6 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the PATHINFO or 2 an arbitrary parameter...
CVE-2012-4928: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in owupdates/index.php in Oxwall 1.1.1 allows remote attackers to inject arbitrary web script or HTML via the plugin parameter...
PT-2012-5662
Name of the Vulnerable Software and Affected Versions Limesurvey versions prior to 1.91+ Build 120224 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the fieldnames parameter to the "index.php" endpoint. Recommendations For versions prior to...
PT-2012-5663
Name of the Vulnerable Software and Affected Versions Oxwall version 1.1.1 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the plugin parameter in the ow updates/index.php file...
CVE-2012-4927: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in Limesurvey a.k.a PHPSurveyor before 1.91+ Build 120224 and earlier allows remote attackers to execute arbitrary SQL commands via the fieldnames parameter to index.php...
CVE-2012-1469: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in Open Journal Systems before 2.3.7 allow remote attackers and remote authenticated users to inject arbitrary web script or HTML via the 1 editor or 2 callback parameters to lib/pkp/lib/tinymce/jscripts/tinymce/plugins/ibrowser/ibrowser.php in th...
CVE-2012-1112: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in Open-Realty CMS 2.5.8 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the selectuserstemplate parameter to index.php...
PT-2012-3086
Name of the Vulnerable Software and Affected Versions Open-Realty CMS versions 2.5.8 and earlier Description A directory traversal issue allows remote attackers to include and execute arbitrary local files. This is achieved by using a .. dot dot in the select users template parameter to the...
PT-2012-3294
Name of the Vulnerable Software and Affected Versions Open Journal Systems versions prior to 2.3.7 Description The issue allows remote attackers and remote authenticated users to inject arbitrary web script or HTML. This can be achieved via the editor or callback parameters to...
CVE-2012-4870: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in FreePBX 2.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 context parameter to panel/indexamp.php or 2 panel/dhtml/index.php; 3 clid or 4 clidname parameters to panel/flash/mypage.php; 5 PATHINFO to...