CVE-2011-3835

Multiple cross-site scripting XSS vulnerabilities in Wuzly 2.0 allow remote attackers to inject arbitrary web script or HTML via the Referer header to 1 admin/login.php and 2 admin/404.php; the 3 q parameter to search.php; the 4 themename parameter to themesettings.php, 5 extensionname parameter ...

CVE-2011-3838

Multiple SQL injection vulnerabilities in Wuzly 2.0 allow remote attackers to execute arbitrary SQL commands via the 1 u parameter to fp.php, 2 epage parameter to newpage.php, 3 epost parameter to newpost.php, and 4 username parameter to login.php in admin/; or the 5 username parameter to...

PT-2011-4722

Name of the Vulnerable Software and Affected Versions Wuzly version 2.0 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via several parameters, including the u parameter to "fp.php", the epage parameter to "newpage.php", the epost parameter to...

CVE-2011-3838: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Wuzly 2.0 allow remote attackers to execute arbitrary SQL commands via the 1 u parameter to fp.php, 2 epage parameter to newpage.php, 3 epost parameter to newpost.php, and 4 username parameter to login.php in admin/; or the 5 username parameter to...

CVE-2011-3835: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Wuzly 2.0 allow remote attackers to inject arbitrary web script or HTML via the Referer header to 1 admin/login.php and 2 admin/404.php; the 3 q parameter to search.php; the 4 themename parameter to themesettings.php, 5 extensionname parameter ...

Infoproject Biznis Heroj (login.php) Authentication Bypass Vulnerability

Summary Biznis Heroj or Business Hero is the first software on the Macedonian market that will help you manage your business processes in your company, such as accounting, production, acquisition, archiving, inventory, and the Cloud. Using the Cloud technology, Biznis Heroj allows you to access t...

Tiki Wiki CMS Groupware 8.1 / 6.4 LTS Cross Site Scripting

Advisory: Tiki Wiki CMS Groupware Stored Cross-Site-Scripting Advisory ID: INFOSERVE-ADV2011-07 Author: Stefan Schurtz Contact: [email protected] Affected Software: Successfully tested on Tiki 8.1 & 6.4 LTS affects all current releases Vendor URL: http://info.tiki.org/ Vendor Status: fixed...

Tiki Wiki CMS Groupware 8.1 - 'show_errors' HTML Injection

source: https://www.securityfocus.com/bid/51128/info Tiki Wiki CMS Groupware is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the...

PT-2011-5124

Name of the Vulnerable Software and Affected Versions Cacti versions prior to 0.8.7h Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands via the login username parameter in the auth login.php file. Recommendations For versions prior to 0.8.7h, update to...

PT-2011-1974

Name of the Vulnerable Software and Affected Versions ScriptsFeed Recipes Listing Portal version 1.0 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the loginid parameter, also known as the UserName field, in the control/admin login.php file...

InverseFlow 2.4 Cross Site Scripting

Exploit Title: InverseFlow v2.4 XSS Vulnerabilities Date: Mon Nov 07 2011 Author: Amir Expl0its We Are : Expl0its , Highersense , Black.spook & H4ckcity.net - zone-hc.com Software Link: http://asria.info/download/script/inverseflow.zip Version: InverseFlow v2.4 Vulnerable Page:...

Sql injection

SQL injection vulnerability in admin/login.php in jSite 1.0 OE allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

PT-2011-1293

Name of the Vulnerable Software and Affected Versions jSite version 1.0 OE Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the username parameter in the "admin/login.php" endpoint. Recommendations For jSite version 1.0 OE, consider...

CVE-2008-7301: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/login.php in jSite 1.0 OE allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2011-3371

Multiple cross-site scripting XSS vulnerabilities in include/functions.php in PunBB before 1.3.6 allow remote attackers to inject arbitrary web script or HTML via the 1 id, 2 formsent, 3 csrftoken, 4 reqconfirm, or 5 delete parameter to delete.php, the 6 id, 7 formsent, 8 csrftoken, 9 reqmessage,...

CVE-2011-3371: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in include/functions.php in PunBB before 1.3.6 allow remote attackers to inject arbitrary web script or HTML via the 1 id, 2 formsent, 3 csrftoken, 4 reqconfirm, or 5 delete parameter to delete.php, the 6 id, 7 formsent, 8 csrftoken, 9 reqmessage,...

Cross site scripting

Cross-site scripting XSS vulnerability in login.php in Eclime 1.1.2b allows remote attackers to inject arbitrary web script or HTML via the reason parameter in a fail action...

CVE-2010-4842

The vulnerability is a SQL injection in admin/login.php of the MHP DownloadScript (aka MH Products Download Center) version 2.2. The root cause is improper handling of the Name parameter, enabling remote attackers to craft inputs that cause arbitrary SQL execution. Impact per sources is uncontrol...

CVE-2010-4852

CVE-2010-4852 affects Eclime 1.1.2b, where login.php’s reason parameter is vulnerable to cross-site scripting (XSS) due to insufficient input sanitization. Exploitation could cause arbitrary script/HTML execution in a user’s browser. Concrete details across connected records confirm the vulnerabl...

CVE-2010-4852: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in login.php in Eclime 1.1.2b allows remote attackers to inject arbitrary web script or HTML via the reason parameter in a fail action...