CVE-2012-2105

Timesheet Next Gen 1.5.2 contains multiple SQL injection vulnerabilities in login.php that allow remote attackers to execute arbitrary SQL commands through the username or password parameters. This CVE entry is supported by NVD/NVD-derived records and multiple references. No remediation or fix de...

CVE-2012-2105: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in login.php in Timesheet Next Gen 1.5.2 allow remote attackers to execute arbitrary SQL commands via the 1 username or 2 password parameters...

PT-2012-3811

Name of the Vulnerable Software and Affected Versions Timesheet Next Gen version 1.5.2 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the username or password parameters in the login.php file. Recommendations For Timesheet Next Gen version...

Cross site scripting

Cross-site scripting XSS vulnerability in admin/login.php in Newscoop before 3.5.5 allows remote attackers to inject arbitrary web script or HTML via the fusername parameter...

CVE-2012-4679

CVE-2012-4679: A cross-site scripting (XSS) vulnerability exists in Newscoop's admin/login.php prior to version 3.5.5, exploitable via the f_user_name parameter to inject arbitrary web script/HTML. The issue stems from insufficient input handling in that parameter, enabling remote attackers to ex...

CVE-2012-4679

Cross-site scripting XSS vulnerability in admin/login.php in Newscoop before 3.5.5 allows remote attackers to inject arbitrary web script or HTML via the fusername parameter...

PT-2012-5546

Name of the Vulnerable Software and Affected Versions Newscoop versions prior to 3.5.5 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the f user name parameter in the "admin/login.php" endpoint. Recommendations For versions prior to...

CVE-2012-4679: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/login.php in Newscoop before 3.5.5 allows remote attackers to inject arbitrary web script or HTML via the fusername parameter...

Hotel Booking Portal v0.1 Multiple Vulnerabilities

Exploit for php platform in category web applications ----------------------------------------------------------- / | | | | | | | | | | | | | | | | | / |/ |/ \ | | || | || | | | | / | ||\,|,||| ----------------------------------------------------------- Hotel Booking Portal v0.1 Multiple...

InterPhoto Image Gallery 2.5.1 Cross Site Scripting

HTTPCS Advisory : HTTPCS67 Product : InterPhoto Image Gallery Version : 2.5.1 Date : 2012-08-07 Criticality level : Less Critical Description : A vulnerability has been discovered in InterPhoto Image Gallery, which can be exploited by malicious people to conduct cross-site scripting attacks. Inpu...

Symantec Web Gateway 5.0.2.18 pbcontrol.php Command Injection

This module exploits a command injection vulnerability found in Symantec Web Gateway's HTTP service. While handling the filename parameter, the Spywall API does not do any filtering before passing it to an exec call in proxyfile, thus results in remote code execution under the context of the web...

PT-2012-5127

Name of the Vulnerable Software and Affected Versions Sticky Notes versions 0.3.09062012.4 and earlier Description A cross-site scripting issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the username parameter in the "admin/login.php" endpoint...

CVE-2012-3999: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/login.php in Sticky Notes 0.3.09062012.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the username parameter...

PT-2012-4240

Name of the Vulnerable Software and Affected Versions Login With Ajax plugin versions prior to 3.0.4.1 Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML. This is achieved via the callback parameter in a lostpassword action to wp-login.php...

Multiple vulnerabilities in osCmax

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in osCmax, which can be exploited to perform SQL Injection and Cross-Site Scripting XSS attacks. 1 Multiple Cross-Site Scripting XSS in osCmax: CVE-2012-1664 1.1 Input passed via the "username" POST parameter to...

Open redirect

Multiple open redirect vulnerabilities in CubeCart 3.0.20 and earlier allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the 1 r parameter to switch.php or 2 goto parameter to admin/login.php...

PT-2012-2918

Name of the Vulnerable Software and Affected Versions CubeCart versions 3.0.20 and earlier Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. This can be achieved via a URL in the r parameter to "switch.php" or the goto parameter t...

CVE-2012-0865: Improper Input Validation

Multiple open redirect vulnerabilities in CubeCart 3.0.20 and earlier allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the 1 r parameter to switch.php or 2 goto parameter to admin/login.php...

CVE-2012-1224: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in system/classes/login.php in ContentLion Alpha 1.3 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO...

PT-2012-3147

Name of the Vulnerable Software and Affected Versions ContentLion Alpha version 1.3 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the PATH INFO in system/classes/login.php. Recommendations For ContentLio...