97 matches found
CVE-2017-17780: Improper Neutralization of Input During Web Page Generation
The Clockwork SMS clockwork-test-message.php component has XSS via a crafted "to" parameter in a clockwork-test-message request to wp-admin/admin.php. This component code is found in the following WordPress plugins: Clockwork Free and Paid SMS Notifications 2.0.3, Two-Factor Authentication -...
CVE-2017-17586
FS Olx Clone 1.0 has SQL Injection via the subpage.php scat parameter or the message.php pid parameter...
Sql injection
FS Olx Clone 1.0 has SQL Injection via the subpage.php scat parameter or the message.php pid parameter...
CVE-2017-17586
FS Olx Clone 1.0 has SQL Injection via the subpage.php scat parameter or the message.php pid parameter...
CVE-2017-17586
FS Olx Clone 1.0 is affected by a SQL Injection vulnerability exposed via the scat parameter in subpage.php or the pid parameter in message.php. The issue is caused by improper handling of user-supplied input in these parameters, enabling remote attackers to inject SQL commands. Public references...
CVE-2017-17586: Improper Neutralization of Special Elements used in an SQL Command
FS Olx Clone 1.0 has SQL Injection via the subpage.php scat parameter or the message.php pid parameter...
Multiple SQL Injection Vulnerabilities in phpaaCMS
phpaaCMS is a simple article management system. A SQL injection vulnerability exists in /search.php and /message.php in phpaaCMS v0.5, which can be exploited by attackers to obtain sensitive information about the database...
Design/Logic Flaw
PHPMyWind 5.3 has XSS in shoppingcart.php, related to message.php, admin/message.php, and admin/messageupdate.php...
CVE-2017-12984
PHPMyWind 5.3 has XSS in shoppingcart.php, related to message.php, admin/message.php, and admin/messageupdate.php...
CVE-2017-12984
PHPMyWind 5.3 is affected by a cross-site scripting (XSS) vulnerability in shoppingcart.php, with related exposure through message.php and admin/message*. The CVE-2017-12984 entry confirms XSS in shoppingcart.php and references associated files (message.php, admin/message.php, admin/message_updat...
CVE-2017-12984: Improper Neutralization of Input During Web Page Generation
PHPMyWind 5.3 has XSS in shoppingcart.php, related to message.php, admin/message.php, and admin/messageupdate.php...
phpaaCms message.php SQL Injection Vulnerability
No description provided by source...
MetInfo 5.3 \message\message.php 存储型 XSS 漏洞
MetInfo5.3,从官网下的最新安装包之后，在自己的服务器上面搭建之后正式开始测试 首先来看问题页面 MetInfo5.3\message\message.php 这个文件里面 php if!$Captcha-CheckCode$code echo" alert'$langmembercode'; window.history.back;"; exit; 该段代码里面去除了SCRIPT关键字，所以当我们直接提交的时候 用户提交那块会直接清空，管理员则是去除关键字 现在我们触发该存储XSS 测试过程： alert'test' 我们将该测试xss进行编码 编码方式为HTML实体（DEC）...
kppw最新版前台sql注入
简要描述： 我这么认真，你们还是给我点对应的rank吧 详细说明： 算上关联的函数，本来还有很多的，我自己也没有找了， 我测试的是utf版本的，你们gbk版本由于这个问题已经炸了，希望好好审查 下面我拿 control\user\messagesend.php文件举例，同样问题的我找的还有 message.php,yijia.php setUid $gUid ; $objMsgM-setUsername $username ; $objMsgM-setTouid $arrSpaceInfo 'uid' ; $objMsgM-setTousername $arrSpaceInfo...
benjunto.com XSS vulnerability
Vulnerable URL: http://benjunto.com/message.php?subject=" Details: Description| Value ---|--- Patched:| No Latest check for patch:| 25.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated Google Pagerank| 3 VIP website status:| No Check...
Doyo建站 SQL注入
简要描述： 两头牛在一起吃草，青牛问黑牛：“喂！你的草是什么味道？” 黑牛道：“草莓味！” 青牛靠过来吃了一口，愤怒地喊到：“你骗我！” 黑牛轻蔑地看他一眼，回道：“笨蛋，我说草没味。” 详细说明： 1 source\message.php function add if$GLOBALS'GDY''vercode'==1 if!$this-syArgs"vercode",1||md5strtolower$this-syArgs"vercode",1!=$SESSION'doyoverify'message"验证码错误"; if!$this-syArgs'tid'message"请选择栏目...
CVE-2014-8998: Improper Control of Generation of Code
lib/message.php in X7 Chat 2.0.0 through 2.0.5.1 allows remote authenticated users to execute arbitrary PHP code via a crafted HTTP header to index.php, which is processed by the pregreplace function with the eval switch...
X7 Chat 2.0.5 lib/message.php preg_replace() PHP Code Execution Exploit
This Metasploit module exploits a post-auth vulnerability found in X7 Chat versions 2.0.0 up to 2.0.5.1. The vulnerable code exists on lib/message.php, which uses pregreplace function with the /e modifier. This allows a remote authenticated attacker to execute arbitrary PHP code in the remote...
CityPost PHP LNKX 52.0 Message.PHP Cross-Site Scripting Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/13255/info CityPost PHP LNKX is affected by a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input to the 'message.php' script. An attacker may...