64 matches found
EUVD-2007-2363
Malware in sbrugna...
EUVD-2006-1676
Malware in sbrugna...
EUVD-2006-3280
Malware in sbrugna...
liquid.formedica.com.pl XSS vulnerability
Open Bug Bounty ID: OBB-544269 Description| Value ---|--- Affected Website:| liquid.formedica.com.pl Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
Piwigo 2.6.0 /picture.php SQL注入漏洞
/include/functionsrate.inc.php if !isset$rate or !$conf'rate' or !inarray$rate, $conf'rateitems' return false; …….. pwgquery$query; $query = ' INSERT INTO '.RATETABLE.' userid,anonymousid,elementid,rate,date VALUES ' .$user'id'.',' .'''.$anonymousid.'',' .$imageid.',' .$rate .',NOW ;';...
CVE-2014-9115
SQL injection vulnerability in the ratepicture function in include/functionsrate.inc.php in Piwigo before 2.5.5, 2.6.x before 2.6.4, and 2.7.x before 2.7.2 allows remote attackers to execute arbitrary SQL commands via the rate parameter to picture.php, related to an improper data type in a...
CVE-2014-9115
SQL injection vulnerability in the ratepicture function in include/functionsrate.inc.php in Piwigo before 2.5.5, 2.6.x before 2.6.4, and 2.7.x before 2.7.2 allows remote attackers to execute arbitrary SQL commands via the rate parameter to picture.php, related to an improper data type in a...
CVE-2014-9115
SQL injection vulnerability in the ratepicture function in include/functionsrate.inc.php in Piwigo before 2.5.5, 2.6.x before 2.6.4, and 2.7.x before 2.7.2 allows remote attackers to execute arbitrary SQL commands via the rate parameter to picture.php, related to an improper data type in a...
CVE-2014-9115
SQL injection vulnerability in the ratepicture function in include/functionsrate.inc.php in Piwigo before 2.5.5, 2.6.x before 2.6.4, and 2.7.x before 2.7.2 allows remote attackers to execute arbitrary SQL commands via the rate parameter to picture.php, related to an improper data type in a...
CVE-2014-9115: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in the ratepicture function in include/functionsrate.inc.php in Piwigo before 2.5.5, 2.6.x before 2.6.4, and 2.7.x before 2.7.2 allows remote attackers to execute arbitrary SQL commands via the rate parameter to picture.php, related to an improper data type in a...
PT-2014-8834
Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 2.5.5 Piwigo versions 2.6.x prior to 2.6.4 Piwigo versions 2.7.x prior to 2.7.2 Description The issue allows remote attackers to execute arbitrary SQL commands via the rate parameter to "picture.php". This is related t...
Piwigo 'rate' Parameter SQLi Vulnerability
Piwigo is prone to an SQL injection SQLi vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:piwigo:piwigo";...
Lazarus Guestbook 1.6 picture.php img Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/18956/info Lazarus Guestbook is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code execute...
webSPELL <= 4.2.0d Local File Disclosure Exploit (.c linux)
No description provided by source. / webSPELL = 4.2.0d Local File Disclosure Exploit .c linux by Juri Gianni aka yeat - stakerathotmaildotit Description ----------- webSPELL contains one flaw that allows an attacker to disclose a local file. The issue is due to 'picture.php' script not properly...
WebSPELL <= 4.01.02 (picture.php) File Disclosure Vulnerability
No description provided by source. WebSPELL = 4.01.02 picture.php Remote File Disclosure Vulnerability Discovered by: Trex Visit: www.Trex-Online.net / www.UnderGround.ag Comment: Happy easter! / \ / \ / / / \ \ / \ /\ // / GIVE ME A CARROT OR I WILL \ \O O/ \ BLOW UP YOUR HOUSE / / ^ \ / / /...
PT-2012-3960
Name of the Vulnerable Software and Affected Versions Galette versions 0.63 through 0.63.3 Galette version 0.64rc1 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the id adh parameter to "picture.php". Recommendations For Galette versions 0.63...
CVE-2012-2338: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in includes/picture.class.php in Galette 0.63, 0.63.1, 0.63.2, 0.63.3, and 0.64rc1 allows remote attackers to execute arbitrary SQL commands via the idadh parameter to picture.php...
piwigo v.2.3.3 SQL Injector
Exploit for php platform in category web applications +--------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : piwigo SQL comments.php?displaymode=albums SQL 1 myerror...
webSPELL <= 4.2.0d Local File Disclosure Exploit (.c linux)
No description provided by source. / webSPELL = 4.2.0d Local File Disclosure Exploit .c linux by Juri Gianni aka yeat - stakerathotmaildotit Description ----------- webSPELL contains one flaw that allows an attacker to disclose a local file. The issue is due to 'picture.php' script not properly...
webSPELL 4.2.0d (Linux) - Local File Disclosure (C)
webSPELL 4.2.0d Linux - Local File Disclosure C / webSPELL ------------------------------ Possible Fix: $file = pregreplace'/^a-zA-Z0-9/','',addslashes$GET'id'; otherwise if $...