PT-2018-11567

Name of the Vulnerable Software and Affected Versions OpenCart versions 3.0.2.0 and earlier Description The issue allows for a CSRF attack via the "index.php?route=account/password" URI, enabling an attacker to change a user's password. This is possible due to a vulnerability in the...

CVE-2018-13067: Cross-Site Request Forgery (CSRF)

/upload/catalog/controller/account/password.php in OpenCart through 3.0.2.0 has CSRF via the index.php?route=account/password URI to change a user's password...

CVE-2018-1000528: Improper Neutralization of Input During Web Page Generation

GONICUS GOsa version before commit 56070d6289d47ba3f5918885954dcceb75606001 contains a Cross Site Scripting XSS vulnerability in change password form html/password.php, 308 that can result in injection of arbitrary web script or HTML. This attack appear to be exploitable via the victim must open ...

sfoex.com XSS vulnerability

Open Bug Bounty ID: OBB-591400 Description| Value ---|--- Affected Website:| sfoex.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

foodplus-amcard.com XSS vulnerability

Open Bug Bounty ID: OBB-591382 Description| Value ---|--- Affected Website:| foodplus-amcard.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

onlinecca.com XSS vulnerability

Open Bug Bounty ID: OBB-591266 Description| Value ---|--- Affected Website:| onlinecca.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2011-5313: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in includes/password.php in Redaxscript 0.3.2 allow remote attackers to execute arbitrary SQL commands via the 1 id or 2 password parameter to the passwordreset program...

Sql injection

Multiple SQL injection vulnerabilities in Gnew 2013.1 allow remote attackers to execute arbitrary SQL commands via the 1 newsid parameter to news/send.php, 2 threadid parameter to posts/edit.php, or 3 useremail parameter to users/password.php or 4 users/register.php. NOTE: these issues were SPLIT...

SiNG cms - Password.php Cross-Site Scripting

SiNG cms - Password.php Cross-Site Scripting source: https://www.securityfocus.com/bid/55168/info SiNG cms is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browse...

SiNG cms 2.9.0 (email) Remote XSS POST Injection Vulnerability

Summary SiNG cms is a free modular Content Management System open source, based on a bunch of PHP / MySQL and intended use of the web server Apache. Description The application is prone to a reflected cross-site scripting vulnerability due to a failure to properly sanitize user-supplied input to...

Unfixed XSS vulnerability at www.farmville-trucos.com

Security researcher RME, has submitted on 27/12/2010 a cross-site-scripting XSS vulnerability affecting www.farmville-trucos.com, which at the time of submission ranked 7220580 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 11/12/2011. It is...

CVE-2008-6752: Improper Input Validation

adminlogin/password.php in the Twitter Clone TClone plugin for ReVou Micro Blogging does not verify the original password before changing passwords, which allows remote attackers to change the administrator's password and gain privileges via a direct request with modified newpass1 and newpass2...

CVE-2008-6729

PHPmotion

CVE-2008-6729: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in password.php in PHPmotion 2.1 and earlier allow remote attackers to hijack the authentication of arbitrary users for requests that modify an account via the 1 password or 2 emailaddress parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in password.php in Scripts For Sites SFS EZ Baby allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly involving the u2 parameter. NOTE: the provenance of this information is unknown; the details are obtained solely...

CVE-2009-0532

Cross-site scripting XSS vulnerability in password.php in Scripts For Sites SFS EZ Baby allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly involving the u2 parameter. NOTE: the provenance of this information is unknown; the details are obtained solely...

CVE-2009-0532

CVE-2009-0532 describes a Cross-Site Scripting (XSS) flaw in password.php of Scripts For Sites (SFS) EZ Baby. The vulnerability allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, potentially involving the u2 parameter. The NVD entry lists a base score of 4.3 (...

CVE-2009-0533: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in password.php in Scripts for Sites EZ Reminder allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly involving the u2 parameter. NOTE: the provenance of this information is unknown; the details are obtained solely...

CVE-2009-0532: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in password.php in Scripts For Sites SFS EZ Baby allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly involving the u2 parameter. NOTE: the provenance of this information is unknown; the details are obtained solely...

Sql injection

SQL injection vulnerability in @1 File Store 2006.03.07 allows remote attackers to execute arbitrary SQL commands via the id parameter to 1 functions.php and 2 user.php in the libs directory, 3 edit.php and 4 delete.php in control/files/, 5 edit.php and 6 delete.php in control/users/, 7 edit.php,...