PT-2012-5185

Name of the Vulnerable Software and Affected Versions Dir2web version 3.0 Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands. This is achieved by manipulating the oid parameter in a homepage action to the "index.php" endpoint. Recommendations For Dir2web...

CVE-2012-3952

CVE-2012-3952 is an XSS vulnerability in phpList 2.10.18 and earlier, occurring in admin/index.php when the unconfirmed parameter is used (page=user). Exploitation can cause arbitrary HTML/script execution in an administrator’s browser. The related advisory confirms a fixed vendor patch: upgrade ...

PT-2012-5160 · Pbboard · Pbboard

Name of the Vulnerable Software and Affected Versions: PBBoard version 2.1.4 Description: The issue allows remote attackers to change the password of arbitrary user accounts. This is achieved by exploiting the new password page, specifically through the member id and new password parameters to th...

CVE-2012-4246: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote attackers to inject arbitrary web script or HTML via the 1 page parameter; or the 2 footer, 3 status, or 4 testtarget parameter in the send page...

CVE-2012-4070: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in system/src/dispatcher.php in Dir2web 3.0 allows remote attackers to execute arbitrary SQL commands via the oid parameter in a homepage action to index.php...

PT-2012-5082

Name of the Vulnerable Software and Affected Versions phplist versions prior to 2.10.19 Description The issue is related to a cross-site scripting XSS vulnerability. This allows remote attackers to inject arbitrary web script or HTML via the unconfirmed parameter to the "user page" in the...

PT-2012-5083

Name of the Vulnerable Software and Affected Versions phplist versions prior to 2.10.19 Description The issue allows remote administrators to execute arbitrary SQL commands. This is achieved via the delete parameter to the 'editattributes' page in 'admin/index.php'. Recommendations For versions...

CVE-2012-4035: Undefined Security Weakness

The newpassword page in PBBoard 2.1.4 allows remote attackers to change the password of arbitrary user accounts via the memberid and newpassword parameters to index.php...

CVE-2012-4034: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in PBBoard 2.1.4 allow remote attackers to execute arbitrary SQL commands via the 1 username parameter to the send page, 2 email parameter to the forget page, 3 password parameter to the forumarchive page, 4 section parameter to the management page, 5...

CVE-2012-3952: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/index.php in phpList before 2.10.19 allows remote attackers to inject arbitrary web script or HTML via the unconfirmed parameter to the user page...

HTTP header injection - ownCloud

A Header injection vulnerability in ownCloud before 4.0.8 allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content from the server via the HTTP url path parameter to index.php. Affected Software ownCloud Server 4.0.8 CVE-2012-5057 Action Taken It is...

Server: HTTP header injection

A Header injection vulnerability in ownCloud before 4.0.8 allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content from the server via the HTTP url path parameter to index.php. For more information please consult the official advisory. This advisory is...

Server: Multiple XSS vulnerabilities

Multiple cross-site scripting XSS vulnerabilities in ownCloud before 4.0.8 allow remote attackers to inject arbitrary web script or HTML via the readyCallback parameter to PUT.swf in apps/filesodfviewer/src/webodf/webodf/flashput/ the root parameter to index.php in apps/gallery/templates/ a...

phpcms v9 index.php本地任意文件包含漏洞

No description provided by source...

CVE-2012-2362

Cross-site scripting XSS vulnerability in blog/lib.php in the blog implementation in Moodle 1.9.x before 1.9.18, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via a crafted parameter to blog/index.php...

CVE-2012-2362: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in blog/lib.php in the blog implementation in Moodle 1.9.x before 1.9.18, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via a crafted parameter to blog/index.php...

NetArt Media iBoutique 4.0 (index.php key parameter) SQL Injection Vulnerability

Exploit for php platform in category web applications Overview: --------- NetArt Media iBoutique SQL Injection Vulnerability. Technical Description: ---------------------- An SQL Injection Vulnerability is present in NetArt Media iBoutique as it fails to sanitise user-supplied input. Input passed...

CVE-2012-3350

The CVE-2012-3350 entry refers to a Blind SQL Injection in Webmatic 3.1.1 (vendor: valarsoft.com) via the Referer HTTP header fed to index.php. The underlying issue is improper sanitization of input used in SQL queries, enabling remote attackers to infer data (e.g., via time-based techniques) and...

CVE-2012-3350: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in Webmatic 3.1.1 allows remote attackers to execute arbitrary SQL commands via the Referer HTTP header...

PT-2012-4659

Name of the Vulnerable Software and Affected Versions Webmatic version 3.1.1 Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands via the Referer HTTP header in the index.php file. Recommendations For Webmatic version 3.1.1, update to a newer version that...