Maian Uploader 4.0 - admin/index.php keywords Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/29051/info Maian Uploader is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to execute arbitrary script code in t...

Maian Uploader 4.0 - index.php keywords Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/29051/info Maian Uploader is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to execute arbitrary script code in t...

Router ONO Hitron CDE-30364 - CSRF Vulnerability

No description provided by source. Exploit Title: Router ONO Hitron CDE-30364 - CSRF Vulnerability Date: 14-9-2013 Exploit Author: Matias Mingorance Svensson - matias.msatowasp.org Vendor Homepage: http://www.ono.es/clientes/te-ayudamos/dudas/internet/equipos/hitron/hitron-cde-30364/ Tested on:...

ThinkSAAS最新版绕过过滤继续注入2处

简要描述： ThinkSAAS最新版绕过过滤继续注入2处 无视gpc，无需登录 详细说明： 之前这个漏洞有 ′ 雨。分析过： WooYun: Thinksaas某处绕过过滤的注射漏洞 现在官方有最新版，做了修改，加了过滤，但是过滤不严格，可以绕过继续注入。 第一处： 现在最新的代码/app/tag/action/addajax.php case "do": $objname = t$POST'objname'; $idname = tsFiltert$POST'idname'; $objid = t$POST'objid'; $tags = t$POST'tags';...

CVE-2014-1840

Cross-site scripting XSS vulnerability in Upload/search.php in MyBB 1.6.12 and earlier allows remote attackers to inject arbitrary web script or HTML via the keywords parameter in a dosearch action, which is not properly handled in a forced SQL error message...

CVE-2014-1840

Cross-site scripting XSS vulnerability in Upload/search.php in MyBB 1.6.12 and earlier allows remote attackers to inject arbitrary web script or HTML via the keywords parameter in a dosearch action, which is not properly handled in a forced SQL error message...

PT-2014-4324

Name of the Vulnerable Software and Affected Versions MyBB versions 1.6.12 and earlier Description A cross-site scripting XSS issue exists due to improper handling of the keywords parameter in a do search action, allowing remote attackers to inject arbitrary web script or HTML. This occurs when a...

CVE-2014-1840: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Upload/search.php in MyBB 1.6.12 and earlier allows remote attackers to inject arbitrary web script or HTML via the keywords parameter in a dosearch action, which is not properly handled in a forced SQL error message...

XDcms Sql Injection 51-54

简要描述： Sql Injection 详细说明： 注入在XDCMS企业管理系统后台的关键词管理处，\system\modules\xdcms\keywords.php文件： 当我们添加或者编辑关键词时会调用addsave和editsave函数，4个注入点就出现在这两个函数里： addsave函数： public function addsave $title=safehtml$POST'title';//注入点1，可大写绕过 $url=$POST'url';//注入点2，没过滤 ifempty$title||empty$url...

MyBB 'search.php'跨站脚本漏洞

BUGTRAQ ID: 65344 CVECAN ID: CVE-2014-1840 MyBB是一个功能完整并且非常实用的论坛软件。 MyBB 1.6.12及其他版本没有正确过滤search.php的参数值，在实现上存在跨站脚本漏洞，攻击者可利用此漏洞在受影响站点上下文中的用户浏览器内执行任意脚本代码。 0 MyBB MyBB 1.6.12 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.mybb.com/ html body form name="exploit"...

Webers CMS XSS / LFI / SQL Injection

Exploit Title: Webers CMS Multiple Vulnerability Date: 2013 5 November Author: Hossein Hezami Dr.3v1l Vendor: http://www.webers.gr Version: All Version Security Risk: High Category: WebApps Google Keywords: intext:"created by Webers" site:gr Tested on: Linux Exploit : XSS / SQL Injection / LFI /...

Onpub CMS 1.4/1.5 - Multiple SQL Injections

Document Title: =============== Onpub CMS 1.4 & 1.5 - Multiple SQL Injection Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1120 Release Date: ============= 2013-10-26 Vulnerability Laboratory ID VL-ID: ==================================...

Onpub CMS 1.4 & 1.5 - Multiple SQL Injection Vulnerabilities

Document Title: =============== Onpub CMS 1.4 & 1.5 - Multiple SQL Injection Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1120 Release Date: ============= 2013-10-25 Vulnerability Laboratory ID VL-ID: ==================================...

Onpub CMS 1.4 / 1.5 SQL Injection

Document Title: =============== Onpub CMS 1.4 & 1.5 - Multiple SQL Injection Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1120 Release Date: ============= 2013-10-26 Vulnerability Laboratory ID VL-ID: ==================================...

Ubuntu 11.10 / 12.04 LTS / 12.10 : haproxy vulnerabilities (USN-1800-1)

It was discovered that HAProxy incorrectly handled configurations where global.tune.bufsize was set to a value higher than the default. A remote attacker could use this issue to cause a denial of service, or possibly execute arbitrary code. CVE-2012-2942 Yves Lafon discovered that HAProxy...

Cross site scripting

Cross-site scripting XSS vulnerability in Final Beta Laboratory MyWebSearch before 1.23 allows remote attackers to inject arbitrary web script or HTML via the keywords parameter...

CVE-2012-4018

Cross-site scripting XSS vulnerability in Final Beta Laboratory MyWebSearch before 1.23 allows remote attackers to inject arbitrary web script or HTML via the keywords parameter...

CVE-2012-4018: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Final Beta Laboratory MyWebSearch before 1.23 allows remote attackers to inject arbitrary web script or HTML via the keywords parameter...

PT-2012-5145

Name of the Vulnerable Software and Affected Versions Final Beta Laboratory MyWebSearch versions prior to 1.23 Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the keywords parameter. This can lead to the execution of malicious scripts on...

Worry-free shopping system ASP professional version injection vulnerability-vulnerability warning-the black bar safety net

Dark clouds to see, and edit it.. Google keywords: inurl:views. asp? hwid= Injection point: www.myhack58.com/views.asp?hwid=512 ! POST injection vulnerability !...