PT-2018-13662

Name of the Vulnerable Software and Affected Versions Blackcat CMS version 1.3.2 Description The issue allows for XSS via the page title at backend/pages/modify.php, specifically when accessing the willkommen.php?lang=DE page. Recommendations For Blackcat CMS version 1.3.2, update the modify.php...

Cross site scripting

Cross-site scripting XSS vulnerability in backend/pages/modify.php in BlackCatCMS 1.3 allows remote authenticated users with the Admin role to inject arbitrary web script or HTML via the search panel...

CVE-2018-10821: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in backend/pages/modify.php in BlackCatCMS 1.3 allows remote authenticated users with the Admin role to inject arbitrary web script or HTML via the search panel...

CVE-2016-9455: Cross-Site Request Forgery (CSRF)

Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery CSRF. A number of scripts in Revive Adserver's user interface are vulnerable to CSRF attacks: www/admin/banner-acl.php, www/admin/banner-activate.php, www/admin/banner-advanced.php, www/admin/banner-modify.php,...

CVE-2015-0553

Affects WebsiteBaker 2.8.3 SP3: admin/pages/modify.php exposes a reflecting XSS via the page_id parameter. Impact is script execution in the context of the user’s browser. No remediation details are provided in the connected documents; CVSSv2 base score is 4.3 (Medium). Exploitation details appea...

CVE-2015-0553: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/pages/modify.php in WebsiteBaker 2.8.3 SP3 allows remote attackers to inject arbitrary web script or HTML via the pageid parameter...

WebsiteBaker 'modify.php' Cross-Site Scripting Vulnerability

WebsiteBaker is an open source PHP web content management system . A cross-site scripting vulnerability exists in WebsiteBaker 'modify.php' because the application fails to properly filter user-supplied input. An attacker may be able to exploit this issue to execute arbitrary script code in the...

CVE-2014-9242

SQL injection vulnerability in admin/pages/modify.php in WebsiteBaker 2.8.3 allows remote attackers to execute arbitrary SQL commands via the pageid parameter...

CVE-2014-9242: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/pages/modify.php in WebsiteBaker 2.8.3 allows remote attackers to execute arbitrary SQL commands via the pageid parameter...

CVE-2007-3222

Summary (CVE-2007-3222) : A PHP remote file inclusion vulnerability exists in the XFSection 1.07 module for XOOPS, specifically in modify.php where the dir_module parameter is unsafely used to include PHP code. This allows an attacker to cause arbitrary PHP code execution by supplying a crafted U...

XOOPS XFSection Module modify.php dir_module Parameter Remote File Inclusion

The remote host is running XFSection, a third-party module for XOOPS. The version of this module installed on the remote host fails to sanitize input to the 'dirmodule' parameter of the 'modify.php' script before using it to include PHP code. Regardless of PHP's 'registerglobals' setting, an...

CVE-2007-3222: Undefined Security Weakness

PHP remote file inclusion vulnerability in modify.php in the XFsection 1.07 module for XOOPS allows remote attackers to execute arbitrary PHP code via a URL in the dirmodule parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in admin/modify.php in Sam Crew MyBlog remote attackers to inject arbitrary web script or HTML via the id parameter...

CVE-2007-1969

Cross-site scripting XSS vulnerability in admin/modify.php in Sam Crew MyBlog remote attackers to inject arbitrary web script or HTML via the id parameter...

CVE-2007-1969: Undefined Security Weakness

Cross-site scripting XSS vulnerability in admin/modify.php in Sam Crew MyBlog remote attackers to inject arbitrary web script or HTML via the id parameter...

indexu-xss.txt

vulnerability script indexu all versions Found by :SwEET-DeViL & viP HaCkEr & HaCkEr sUn TeaM AL-GaRNi Application : indexu version : all versions URL : http://www.nicecoder.com/ google : "Powered by INDEXU 5." Exploits : |//1\| in upgrade.php...

vulnerability script indexu all versions

vulnerability script indexu all versions Found by :SwEET-DeViL & viP HaCkEr & HaCkEr sUn TeaM AL-GaRNi Application : indexu version : all versions URL : http://www.nicecoder.com/ google : "Powered by INDEXU 5." Exploits : |//1| in upgrade.php...

CVE-2006-4767

The CVE-2006-4767 entry concerns Stefan Ernst Newsscript (aka WM-News) 0.5beta. The described vulnerabilities are directory traversal flaws caused by improper handling of a .. sequence: (1) in modify.php with the ide parameter could allow reading arbitrary local files, and (2) in add_go.php with ...

CVE-2006-4767

Multiple directory traversal vulnerabilities in Stefan Ernst Newsscript aka WM-News 0.5beta allow remote attackers to 1 read arbitrary local files via a .. dot dot sequence in the ide parameter in modify.php and 2 write to arbitrary local files via a .. sequence in the var parameter in addgo.php...

CVE-2006-4767: Undefined Security Weakness

Multiple directory traversal vulnerabilities in Stefan Ernst Newsscript aka WM-News 0.5beta allow remote attackers to 1 read arbitrary local files via a .. dot dot sequence in the ide parameter in modify.php and 2 write to arbitrary local files via a .. sequence in the var parameter in addgo.php...