Maian Gallery 2.0 SQL Injection / Header Injection

| Title : Maian Gallery v2.0 Mulllti Vulnerability | Author : indoushka | email : [email protected] | Dork : Maian Gallery v2.0. Copyright © 2006-2015 Maian Script World. All Rights Reserved | Tested on: Win 8.1 fr pro / 21:58 15/05/2015 | Bug : Mulllti | Download :...

CVE-2014-10007

Multiple cross-site scripting XSS vulnerabilities in Maian Weblog 4.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 name, 2 email, or 3 subject parameter in a contact action to index.php...

CVE-2014-10006

Multiple cross-site request forgery CSRF vulnerabilities in Maian Uploader 4.0 allow remote attackers to hijack the authentication of unspecified users for requests that conduct cross-site scripting XSS attacks via the width parameter to 1 uploader/admin/js/loadflv.js.php or 2...

CVE-2014-10005

Maian Uploader 4.0 allows remote attackers to obtain sensitive information via a request without the height parameter to loadflv.js.php, which reveals the installation path in an error message...

CVE-2014-10004

SQL injection vulnerability in admin/datafiles/move.php in Maian Uploader 4.0 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2014-10003

Multiple cross-site scripting XSS vulnerabilities in Maian Uploader 4.0 allow remote attackers to inject arbitrary web script or HTML via the width parameter to 1 uploader/admin/js/loadflv.js.php or 2 uploader/js/loadflv.js.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Maian Uploader 4.0 allow remote attackers to inject arbitrary web script or HTML via the width parameter to 1 uploader/admin/js/loadflv.js.php or 2 uploader/js/loadflv.js.php...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Maian Uploader 4.0 allow remote attackers to hijack the authentication of unspecified users for requests that conduct cross-site scripting XSS attacks via the width parameter to 1 uploader/admin/js/loadflv.js.php or 2...

Sql injection

SQL injection vulnerability in admin/datafiles/move.php in Maian Uploader 4.0 allows remote attackers to execute arbitrary SQL commands via the id parameter...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Maian Weblog 4.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 name, 2 email, or 3 subject parameter in a contact action to index.php...

Design/Logic Flaw

Maian Uploader 4.0 allows remote attackers to obtain sensitive information via a request without the height parameter to loadflv.js.php, which reveals the installation path in an error message...

CVE-2014-10004

SQL injection vulnerability in admin/datafiles/move.php in Maian Uploader 4.0 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2014-10005

CVE-2014-10005 affects Maian Uploader 4.0. The issue arises when requesting load_flv.js.php without the required height parameter, which may cause an error message that reveals the installation path. This is a potential information disclosure in the affected component (load_flv.js.php). The docum...

CVE-2014-10007

Multiple cross-site scripting XSS vulnerabilities in Maian Weblog 4.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 name, 2 email, or 3 subject parameter in a contact action to index.php...

CVE-2014-10004

Maian Uploader 4.0 is affected by a SQL injection in admin/data_files/move.php via the id parameter, enabling remote attackers to execute arbitrary SQL commands. No exploit specifics or mitigation details are provided in the connected documents; implications are partial confidentiality/integrity ...

CVE-2014-10005

Maian Uploader 4.0 allows remote attackers to obtain sensitive information via a request without the height parameter to loadflv.js.php, which reveals the installation path in an error message...

CVE-2014-10006

Maian Uploader 4.0 is affected by multiple CSRF vulnerabilities that allow an attacker to hijack user authentication for requests that trigger XSS via the width parameter in uploader/admin/js/load_flv.js.php and uploader/js/load_flv.js.php. The CVE description indicates these are CSRF issues lead...

CVE-2014-10007

CVE-2014-10007 : Multiple cross-site scripting (XSS) vulnerabilities in Maian Weblog 4.0 and earlier allow remote attackers to inject arbitrary script/HTML via the name, email, or subject parameters in a contact action to index.php. The affected software is Maian Weblog (versions up to 4.0 and ea...

CVE-2014-10006

Multiple cross-site request forgery CSRF vulnerabilities in Maian Uploader 4.0 allow remote attackers to hijack the authentication of unspecified users for requests that conduct cross-site scripting XSS attacks via the width parameter to 1 uploader/admin/js/loadflv.js.php or 2...

CVE-2014-10003

CVE-2014-10003 affects Maian Uploader 4.0. The connected documents confirm multiple cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary web script or HTML through the width parameter in either uploader/admin/js/load_flv.js.php or uploader/js/load_flv.js.php....