EUVD-2012-6434

Malware in sbrugna...

Cross site scripting

Cross-site scripting XSS vulnerability in vacation/1mobile/alertmembers.php in MYRE Vacation Rental Software allows remote attackers to inject arbitrary web script or HTML via the linkidd parameter in a login action...

CVE-2012-6587: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in vacation/1mobile/alertmembers.php in MYRE Vacation Rental Software allows remote attackers to inject arbitrary web script or HTML via the linkidd parameter in a login action...

CVE-2012-4258: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in MYRE Real Estate Software 2012 Q2 allow remote attackers to execute arbitrary SQL commands via the 1 linkidd parameter to 1mobile/listings.php or 2 userid parameter to 1mobile/agentprofile.php...