Multiple Vulnerabilities in BloofoxCMS

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in BloofoxCMS which could be exploited to perform cross-site request forgery and SQL injection attacks. 1 Cross-site request forgery CSRF in BloofoxCMS The vulnerability exists due to insufficient validation of the...

CVE-2010-0804: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in iBoutique 4.0 allows remote attackers to inject arbitrary web script or HTML via the key parameter in a products action...

CVE-2009-3196

Cross-site scripting XSS vulnerability in index.php in JCE-Tech PHP Video Script allows remote attackers to inject arbitrary web script or HTML via the key parameter...

CVE-2009-3196: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in JCE-Tech PHP Video Script allows remote attackers to inject arbitrary web script or HTML via the key parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in visitor/view.php in GarageSales Script allows remote attackers to inject arbitrary web script or HTML via the key parameter. NOTE: some of these details are obtained from third party information...

CVE-2009-2777

SQL injection vulnerability in visitor/view.php in GarageSales Script allows remote attackers to execute arbitrary SQL commands via the key parameter...

CVE-2009-2778

Cross-site scripting XSS vulnerability in visitor/view.php in GarageSales Script allows remote attackers to inject arbitrary web script or HTML via the key parameter. NOTE: some of these details are obtained from third party information...

CVE-2009-2777

SQL injection vulnerability in visitor/view.php in GarageSales Script allows remote attackers to execute arbitrary SQL commands via the key parameter...

CVE-2009-2778: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in visitor/view.php in GarageSales Script allows remote attackers to inject arbitrary web script or HTML via the key parameter. NOTE: some of these details are obtained from third party information...

CVE-2009-2777: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in visitor/view.php in GarageSales Script allows remote attackers to execute arbitrary SQL commands via the key parameter...

WordPress < 2.8.4 'wp-login.php' 'key' Parameter Remote Administrator Password Reset (uncredentialed check)

According to its version number, the version of WordPress running on the remote server has a flaw in the password reset mechanism. Validation of the secret user activation key can be bypassed by providing an array instead of a string. This allows anyone to reset the password of the first user in...

CVE-2009-2598: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Online Grades & Attendance 3.2.6 and earlier allow 1 remote attackers to execute arbitrary SQL commands via the key parameter in a resetpass action to index.php and 2 remote authenticated users to execute arbitrary SQL commands via the ADD parameter in a...

CVE-2009-2209

SQL injection vulnerability in rscmsmodnewsview.php in RS-CMS 2.1 allows remote attackers to execute arbitrary SQL commands via the key parameter...

Sql injection

SQL injection vulnerability in rscmsmodnewsview.php in RS-CMS 2.1 allows remote attackers to execute arbitrary SQL commands via the key parameter...

CVE-2009-2209: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in rscmsmodnewsview.php in RS-CMS 2.1 allows remote attackers to execute arbitrary SQL commands via the key parameter...

CVE-2008-6108

Cross-site scripting XSS vulnerability in result.php in Galatolo WebManager GWM 1.0 allows remote attackers to inject arbitrary web script or HTML via the key parameter...

CVE-2008-6108: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in result.php in Galatolo WebManager GWM 1.0 allows remote attackers to inject arbitrary web script or HTML via the key parameter...

CVE-2008-4435

Multiple cross-site scripting XSS vulnerabilities in the RMSOFT Downloads Plus rmdp module 1.5 and 1.7 for Xoops allow remote attackers to inject arbitrary web script or HTML via the 1 key parameter to search.php and the 2 id parameter to down.php...

CVE-2008-4435: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the RMSOFT Downloads Plus rmdp module 1.5 and 1.7 for Xoops allow remote attackers to inject arbitrary web script or HTML via the 1 key parameter to search.php and the 2 id parameter to down.php...

CVE-2008-3266: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in picturepicbv.asp in SoftAcid Hotel Reservation System HRS Multi allows remote attackers to execute arbitrary SQL commands via the key parameter...