CVE-2012-2436

Multiple cross-site scripting XSS vulnerabilities in Pligg CMS before 1.2.2 allow remote attackers to inject arbitrary web script or HTML via 1 an arbitrary parameter in a move or 2 minimize action to admin/adminindex.php; 3 the karmausername parameter to module.php in the karma module; 4 q1low, ...

CVE-2012-2435

Directory traversal vulnerability in the captcha module in Pligg CMS before 1.2.2 allows remote authenticated users to include and execute arbitrary local files via a .. dot dot in the captcha parameter to module.php, as demonstrated by cross-site request forgery CSRF attacks...

CVE-2012-2936

Multiple cross-site scripting XSS vulnerabilities in Pligg CMS before 1.2.2 allow remote attackers to inject arbitrary web script or HTML via the 1 user or 2 page parameter to a admin/admincomments.php or b admin/adminlinks.php; or list parameter in a 3 move or 4 minimize action to c...

CVE-2012-2436

Pligg CMS 1.2.1 is affected by multiple XSS vulnerabilities (CVE-2012-2436) due to insufficient sanitization of inputs in several parameters across admin and module PHP files. Specifically, vectorized input includes arbitrary GET parameters to /admin/admin_index.php (action=move/minimize), the ka...

CVE-2012-2435

Pligg CMS (prior to 1.2.2) has a directory traversal / Local File Inclusion vulnerability in the captcha module (module.php) that allows remote authenticated users to include and execute local files via the captcha parameter, demonstrated as a CSRF-exploitation vector. The CVE entry CVE-2012-2435...

CVE-2012-2937

Multiple SQL injection vulnerabilities in Pligg CMS before 1.2.2 allow remote attackers to execute arbitrary SQL commands via the 1 list parameter in a move action to admin/adminindex.php, 2 display parameter in a minimize action to admin/adminindex.php, 3 enabled parameter to admin/adminusers.ph...

CVE-2012-2936

CVE-2012-2936 affects Pligg CMS prior to 1.2.2. The vulnerability is a set of cross-site scripting (XSS) flaws that allow remote attackers to inject arbitrary script/HTML via: (1) user or (2) page parameters to (a) admin/admin_comments.php or (b) admin/admin_links.php, or the list parameter in a ...

Pligg CMS 1.2.1 Cross Site Scripting / Local File Inclusion

Advisory ID: HTB23089 Product: Pligg CMS Vendor: Pligg, LLC. Vulnerable Versions: 1.2.1 and probably prior Tested Version: 1.2.1 Vendor Notification: 25 April 2012 Vendor Patch: 18 May 2012 Public Disclosure: 23 May 2012 Vulnerability Type: Local File Inclusion, Cross-Site Scripting XSS CVE...

Pligg CMS 1.2.1 Cross Site Scripting / Local File Inclusion

Exploit for php platform in category web applications Product: Pligg CMS Vendor: Pligg, LLC. Vulnerable Versions: 1.2.1 and probably prior Tested Version: 1.2.1 Vendor Notification: 25 April 2012 Vendor Patch: 18 May 2012 Public Disclosure: 23 May 2012 Vulnerability Type: Local File Inclusion,...

Pligg CMS 1.x - 'module.php' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/53662/info Pligg CMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the...

Pligg CMS 1.x - module.php Multiple Cross-Site Scripting Vulnerabilities

Pligg CMS 1.x - module.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/53662/info Pligg CMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to...

Pligg CMS 1.2.1 SQL注入漏洞

Bugtraq ID: 53625 Pligg CMS是一款内容管理系统。 Pligg CMS包含的admin/adminindex.php，admin/adminusers.php，module.php脚本不正确过滤用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，可获得数据库信息或控制应用系统。 0 Pligg CMS 1.2.1 厂商解决方案 Pligg CMS 1.2.2已经修复此漏洞，建议用户下载使用： http://forums.pligg.com/downloads.php?do=file&id=15...

Multiple vulnerabilities in Pligg CMS

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Pligg CMS , which can be exploited to perform Cross-Site Scripting XSS and Local File Inclusion attacks. 1 Multiple Cross-Site Scripting XSS in Pligg CMS: CVE-2012-2436 1.1 Input passed via the arbitrary any GET...

CVE-2011-5023

Cross-site scripting XSS vulnerability in Pligg CMS 1.1.4 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to the search program, a different vulnerability than CVE-2011-3986...

CVE-2011-5022

SQL injection vulnerability in search.php in Pligg CMS 1.1.2 allows remote attackers to execute arbitrary SQL commands via the status parameter...

Sql injection

SQL injection vulnerability in search.php in Pligg CMS 1.1.2 allows remote attackers to execute arbitrary SQL commands via the status parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in Pligg CMS 1.1.4 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to the search program, a different vulnerability than CVE-2011-3986...

CVE-2011-5023

Cross-site scripting XSS vulnerability in Pligg CMS 1.1.4 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to the search program, a different vulnerability than CVE-2011-3986...

CVE-2011-5022

Summary: CVE-2011-5022 affects Pligg CMS 1.1.2, with an SQL injection in search.php via the status parameter. The root cause is improper handling of user-supplied input in the search functionality, enabling arbitrary SQL execution by remote attackers. Impact (as stated): Remote attackers can exec...

CVE-2011-5023

The CVE-2011-5023 entry concerns a Cross-site Scripting (XSS) vulnerability in Pligg CMS 1.1.4 triggered by PATH_INFO to the search program. Root cause: improper handling of PATH_INFO leads to script/HTML injection. Impact: remote attackers could inject arbitrary web scripts or HTML. Affected sof...