Multiple vulnerabilities in osCmax

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in osCmax, which can be exploited to perform SQL Injection and Cross-Site Scripting XSS attacks. 1 Multiple Cross-Site Scripting XSS in osCmax: CVE-2012-1664 1.1 Input passed via the "username" POST parameter to...

Open redirect

Multiple open redirect vulnerabilities in CubeCart 3.0.20 and earlier allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the 1 r parameter to switch.php or 2 goto parameter to admin/login.php...

CVE-2012-1224: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in system/classes/login.php in ContentLion Alpha 1.3 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO...

CVE-2012-0865: Improper Input Validation

Multiple open redirect vulnerabilities in CubeCart 3.0.20 and earlier allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the 1 r parameter to switch.php or 2 goto parameter to admin/login.php...

PT-2012-2918

Name of the Vulnerable Software and Affected Versions CubeCart versions 3.0.20 and earlier Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. This can be achieved via a URL in the r parameter to "switch.php" or the goto parameter t...

PT-2012-3147

Name of the Vulnerable Software and Affected Versions ContentLion Alpha version 1.3 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the PATH INFO in system/classes/login.php. Recommendations For ContentLio...

CVE-2012-1020

CVE-2012-1020 affects NexorONE Online Banking: XSS in login.php where an attacker can inject arbitrary script/HTML by supplying (1) visitor_language to register.php or (2) message parameter. Public records (NVD, CVE List, PRION) confirm the vulnerability across multiple references, with the attac...

CVE-2012-1020: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in login.php in NexorONE Online Banking allow remote attackers to inject arbitrary web script or HTML via the 1 visitorlanguage parameter to register.php or 2 message parameter...

XRayCMS 1.1.1 - SQL Injection

Exploit Title: XRayCMS 1.1.1 SQL Injection Vulnerability Date: 2/5/2012 Author: chap0 Software Link: http://sourceforge.net/projects/xraycms/files/latest/download Version: 1.1.1 Tested on: Ubuntu XRay CMS is vulnerable to a SQL Injection attack which allows authentication bypass into the admins...

CVE-2012-0932

CVE-2012-0932 concerns a cross-site scripting (XSS) vulnerability in Lead Capture Page System’s admin/login.php, exploitable via the message parameter. The issue allows remote attackers to inject arbitrary web script or HTML, as documented in multiple sources (NVD, OpenVAS, CVE listings). The rel...

CVE-2012-0932: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/login.php in Lead Capture Page System allows remote attackers to inject arbitrary web script or HTML via the message parameter...

PT-2012-2959

Name of the Vulnerable Software and Affected Versions Lead Capture Page System affected versions not specified Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the message parameter ...

Lead Capture - login.php Script Cross-Site Scripting

Lead Capture - login.php Script Cross-Site Scripting source: https://www.securityfocus.com/bid/51785/info Lead Capture is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script cod...

Lead Capture - 'login.php' Script Cross-Site Scripting

source: https://www.securityfocus.com/bid/51785/info Lead Capture is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the conte...

Limny 3.0.1 - login.php Script Cross-Site Scripting

Limny 3.0.1 - login.php Script Cross-Site Scripting source: https://www.securityfocus.com/bid/51261/info Limny is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the...

Limny 3.0.1 - 'login.php' Script Cross-Site Scripting

source: https://www.securityfocus.com/bid/51261/info Limny is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of t...

CVE-2011-5039

Multiple SQL injection vulnerabilities in Infoproject Biznis Heroj allow remote attackers to execute arbitrary SQL commands via the 1 username and 2 password parameters to login.php, 3 the filter parameter to widget.dokumentilista.php, and 4 the finnalogid parameter to nalozinaslov.php...

CVE-2011-5039: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Infoproject Biznis Heroj allow remote attackers to execute arbitrary SQL commands via the 1 username and 2 password parameters to login.php, 3 the filter parameter to widget.dokumentilista.php, and 4 the finnalogid parameter to nalozinaslov.php...

PT-2011-5186

Name of the Vulnerable Software and Affected Versions Infoproject Biznis Heroj affected versions not specified Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the username and password parameters to "login.php", the filter parameter to...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Wuzly 2.0 allow remote attackers to inject arbitrary web script or HTML via the Referer header to 1 admin/login.php and 2 admin/404.php; the 3 q parameter to search.php; the 4 themename parameter to themesettings.php, 5 extensionname parameter ...