PT-2014-5011

Name of the Vulnerable Software and Affected Versions XCloner Standalone versions 3.5 and earlier Description The issue allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the dbbackup comp parameter in a generate action to "index2.php". It is...

CVE-2014-2579: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in XCloner Standalone 3.5 and earlier allow remote attackers to hijack the authentication of administrators for requests that 1 change the administrator password via the config task to index2.php or 2 when the enabledbbackup and sqlmem...

PT-2014-4791

Multiple cross-site request forgery CSRF vulnerabilities in XCloner Standalone 3.5 and earlier allow remote attackers to hijack the authentication of administrators for requests that 1 change the administrator password via the config task to index2.php or 2 when the enable db backup and sql mem...

CVE-2014-2996: Improper Control of Generation of Code

XCloner Standalone 3.5 and earlier, when enabledbbackup and sqlmem are enabled, allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the dbbackupcomp parameter in a generate action to index2.php. NOTE: it is not clear whether this issue crosses...

PT-2014-2401

Name of the Vulnerable Software and Affected Versions Vessio NetBill version 1.2 Description The issue allows remote attackers to inject arbitrary web script or HTML, which can lead to cross-site scripting XSS attacks. This is possible via the full name or file title to accounts/admin/index.php, ...

CVE-2012-6632: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Vessio NetBill 1.2 allow remote attackers to inject arbitrary web script or HTML via the 1 full name or 2 file title to accounts/admin/index.php or 3 comment parameter in the support page to accounts/index2.php...

PT-2012-5640

Name of the Vulnerable Software and Affected Versions ManageEngine Firewall Analyzer version 7.2 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the url parameter in the fw/index2.do endpoint. This is a different attack...

PT-2012-5638

Name of the Vulnerable Software and Affected Versions ManageEngine Firewall Analyzer version 7.2 Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting XSS attacks. This can be achieved by manipulating specific parameters ...

CVE-2012-4891: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in fw/index2.do in ManageEngine Firewall Analyzer 7.2 allows remote attackers to inject arbitrary web script or HTML via the url parameter, a different vector than CVE-2012-4889. NOTE: the provenance of this information is unknown; the details are obtained...

Sql injection

SQL injection vulnerability in index2.php in Uiga Fan Club allows remote attackers to execute arbitrary SQL commands via the p parameter...

CVE-2012-4056

SQL injection vulnerability in index2.php in Uiga Personal Portal allows remote attackers to execute arbitrary SQL commands via the p parameter...

CVE-2012-4055

SQL injection vulnerability in index2.php in Uiga Fan Club allows remote attackers to execute arbitrary SQL commands via the p parameter...

CVE-2012-4055

CVE-2012-4055 is a SQL injection vulnerability in index2.php of Uiga Fan Club, allowing remote attackers to execute arbitrary SQL via the p parameter. The issue is caused by improper input handling in that script, enabling potentially unauthorized data access or modification. The connected CIRCL ...

PT-2012-5173

Name of the Vulnerable Software and Affected Versions Uiga Fan Club affected versions not specified Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the p parameter in the "index2.php" endpoint. Recommendations At the moment, there is no...

PT-2012-5174

Name of the Vulnerable Software and Affected Versions Uiga Personal Portal affected versions not specified Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the p parameter in the "index2.php" API endpoint. Recommendations At the moment, there i...

CVE-2012-4056: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index2.php in Uiga Personal Portal allows remote attackers to execute arbitrary SQL commands via the p parameter...

CVE-2012-4055: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index2.php in Uiga Fan Club allows remote attackers to execute arbitrary SQL commands via the p parameter...

PT-2011-4185

Name of the Vulnerable Software and Affected Versions Mambo CMS versions 4.6.5 and earlier Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the zorder parameter in the administrator/index2.php file. Recommendations For Mambo CMS versions 4.6.5...

CVE-2011-2917: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in administrator/index2.php in Mambo CMS 4.6.5 and earlier allows remote attackers to execute arbitrary SQL commands via the zorder parameter...

Uiga Personal Portal - Multiple Vulnerabilities

Uiga Personal Portal - Multiple Vulnerabilities Exploit Title: Uiga Personal Portal Multiple Vulnerability Date: 2011 Author: Eyup CELIK Version: All Version Tested on: All versions are Vulnerability Web Site: www.eyupcelik.com.tr ISSUE Blind SQL Injection and XSS can be done using the command...