CVE-2012-0932: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/login.php in Lead Capture Page System allows remote attackers to inject arbitrary web script or HTML via the message parameter...

Lead Capture - login.php Script Cross-Site Scripting

Lead Capture - login.php Script Cross-Site Scripting source: https://www.securityfocus.com/bid/51785/info Lead Capture is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script cod...

Lead Capture - 'login.php' Script Cross-Site Scripting

source: https://www.securityfocus.com/bid/51785/info Lead Capture is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the conte...

Limny 3.0.1 - login.php Script Cross-Site Scripting

Limny 3.0.1 - login.php Script Cross-Site Scripting source: https://www.securityfocus.com/bid/51261/info Limny is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the...

Limny 3.0.1 - 'login.php' Script Cross-Site Scripting

source: https://www.securityfocus.com/bid/51261/info Limny is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of t...

CVE-2011-5039

Multiple SQL injection vulnerabilities in Infoproject Biznis Heroj allow remote attackers to execute arbitrary SQL commands via the 1 username and 2 password parameters to login.php, 3 the filter parameter to widget.dokumentilista.php, and 4 the finnalogid parameter to nalozinaslov.php...

PT-2011-5186

Name of the Vulnerable Software and Affected Versions Infoproject Biznis Heroj affected versions not specified Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the username and password parameters to "login.php", the filter parameter to...

CVE-2011-5039: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Infoproject Biznis Heroj allow remote attackers to execute arbitrary SQL commands via the 1 username and 2 password parameters to login.php, 3 the filter parameter to widget.dokumentilista.php, and 4 the finnalogid parameter to nalozinaslov.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Wuzly 2.0 allow remote attackers to inject arbitrary web script or HTML via the Referer header to 1 admin/login.php and 2 admin/404.php; the 3 q parameter to search.php; the 4 themename parameter to themesettings.php, 5 extensionname parameter ...

CVE-2011-3835

Multiple cross-site scripting XSS vulnerabilities in Wuzly 2.0 allow remote attackers to inject arbitrary web script or HTML via the Referer header to 1 admin/login.php and 2 admin/404.php; the 3 q parameter to search.php; the 4 themename parameter to themesettings.php, 5 extensionname parameter ...

CVE-2011-3838

Multiple SQL injection vulnerabilities in Wuzly 2.0 allow remote attackers to execute arbitrary SQL commands via the 1 u parameter to fp.php, 2 epage parameter to newpage.php, 3 epost parameter to newpost.php, and 4 username parameter to login.php in admin/; or the 5 username parameter to...

PT-2011-4722

Name of the Vulnerable Software and Affected Versions Wuzly version 2.0 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via several parameters, including the u parameter to "fp.php", the epage parameter to "newpage.php", the epost parameter to...

CVE-2011-3838: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Wuzly 2.0 allow remote attackers to execute arbitrary SQL commands via the 1 u parameter to fp.php, 2 epage parameter to newpage.php, 3 epost parameter to newpost.php, and 4 username parameter to login.php in admin/; or the 5 username parameter to...

CVE-2011-3835: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Wuzly 2.0 allow remote attackers to inject arbitrary web script or HTML via the Referer header to 1 admin/login.php and 2 admin/404.php; the 3 q parameter to search.php; the 4 themename parameter to themesettings.php, 5 extensionname parameter ...

Infoproject Biznis Heroj (login.php) Authentication Bypass Vulnerability

Summary Biznis Heroj or Business Hero is the first software on the Macedonian market that will help you manage your business processes in your company, such as accounting, production, acquisition, archiving, inventory, and the Cloud. Using the Cloud technology, Biznis Heroj allows you to access t...

Tiki Wiki CMS Groupware 8.1 / 6.4 LTS Cross Site Scripting

Advisory: Tiki Wiki CMS Groupware Stored Cross-Site-Scripting Advisory ID: INFOSERVE-ADV2011-07 Author: Stefan Schurtz Contact: [email protected] Affected Software: Successfully tested on Tiki 8.1 & 6.4 LTS affects all current releases Vendor URL: http://info.tiki.org/ Vendor Status: fixed...

Tiki Wiki CMS Groupware 8.1 - 'show_errors' HTML Injection

source: https://www.securityfocus.com/bid/51128/info Tiki Wiki CMS Groupware is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the...

PT-2011-5124

Name of the Vulnerable Software and Affected Versions Cacti versions prior to 0.8.7h Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands via the login username parameter in the auth login.php file. Recommendations For versions prior to 0.8.7h, update to...

PT-2011-1974

Name of the Vulnerable Software and Affected Versions ScriptsFeed Recipes Listing Portal version 1.0 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the loginid parameter, also known as the UserName field, in the control/admin login.php file...

InverseFlow 2.4 Cross Site Scripting

Exploit Title: InverseFlow v2.4 XSS Vulnerabilities Date: Mon Nov 07 2011 Author: Amir Expl0its We Are : Expl0its , Highersense , Black.spook & H4ckcity.net - zone-hc.com Software Link: http://asria.info/download/script/inverseflow.zip Version: InverseFlow v2.4 Vulnerable Page:...