CVE-2012-2436

Multiple cross-site scripting XSS vulnerabilities in Pligg CMS before 1.2.2 allow remote attackers to inject arbitrary web script or HTML via 1 an arbitrary parameter in a move or 2 minimize action to admin/adminindex.php; 3 the karmausername parameter to module.php in the karma module; 4 q1low, ...

CVE-2012-2937

Multiple SQL injection vulnerabilities in Pligg CMS before 1.2.2 allow remote attackers to execute arbitrary SQL commands via the 1 list parameter in a move action to admin/adminindex.php, 2 display parameter in a minimize action to admin/adminindex.php, 3 enabled parameter to admin/adminusers.ph...

CVE-2012-2435

Directory traversal vulnerability in the captcha module in Pligg CMS before 1.2.2 allows remote authenticated users to include and execute arbitrary local files via a .. dot dot in the captcha parameter to module.php, as demonstrated by cross-site request forgery CSRF attacks...

CVE-2012-2936

Multiple cross-site scripting XSS vulnerabilities in Pligg CMS before 1.2.2 allow remote attackers to inject arbitrary web script or HTML via the 1 user or 2 page parameter to a admin/admincomments.php or b admin/adminlinks.php; or list parameter in a 3 move or 4 minimize action to c...

Directory traversal

Directory traversal vulnerability in the captcha module in Pligg CMS before 1.2.2 allows remote authenticated users to include and execute arbitrary local files via a .. dot dot in the captcha parameter to module.php, as demonstrated by cross-site request forgery CSRF attacks...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Pligg CMS before 1.2.2 allow remote attackers to inject arbitrary web script or HTML via the 1 user or 2 page parameter to a admin/admincomments.php or b admin/adminlinks.php; or list parameter in a 3 move or 4 minimize action to c...

Sql injection

Multiple SQL injection vulnerabilities in Pligg CMS before 1.2.2 allow remote attackers to execute arbitrary SQL commands via the 1 list parameter in a move action to admin/adminindex.php, 2 display parameter in a minimize action to admin/adminindex.php, 3 enabled parameter to admin/adminusers.ph...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Pligg CMS before 1.2.2 allow remote attackers to inject arbitrary web script or HTML via 1 an arbitrary parameter in a move or 2 minimize action to admin/adminindex.php; 3 the karmausername parameter to module.php in the karma module; 4 q1low, ...

CVE-2012-2435

Directory traversal vulnerability in the captcha module in Pligg CMS before 1.2.2 allows remote authenticated users to include and execute arbitrary local files via a .. dot dot in the captcha parameter to module.php, as demonstrated by cross-site request forgery CSRF attacks...

CVE-2012-2436

Multiple cross-site scripting XSS vulnerabilities in Pligg CMS before 1.2.2 allow remote attackers to inject arbitrary web script or HTML via 1 an arbitrary parameter in a move or 2 minimize action to admin/adminindex.php; 3 the karmausername parameter to module.php in the karma module; 4 q1low, ...

CVE-2012-2936

Multiple cross-site scripting XSS vulnerabilities in Pligg CMS before 1.2.2 allow remote attackers to inject arbitrary web script or HTML via the 1 user or 2 page parameter to a admin/admincomments.php or b admin/adminlinks.php; or list parameter in a 3 move or 4 minimize action to c...

CVE-2012-2937

Multiple SQL injection vulnerabilities in Pligg CMS before 1.2.2 allow remote attackers to execute arbitrary SQL commands via the 1 list parameter in a move action to admin/adminindex.php, 2 display parameter in a minimize action to admin/adminindex.php, 3 enabled parameter to admin/adminusers.ph...

CVE-2012-2435

Pligg CMS (prior to 1.2.2) has a directory traversal / Local File Inclusion vulnerability in the captcha module (module.php) that allows remote authenticated users to include and execute local files via the captcha parameter, demonstrated as a CSRF-exploitation vector. The CVE entry CVE-2012-2435...

CVE-2012-2436

Pligg CMS 1.2.1 is affected by multiple XSS vulnerabilities (CVE-2012-2436) due to insufficient sanitization of inputs in several parameters across admin and module PHP files. Specifically, vectorized input includes arbitrary GET parameters to /admin/admin_index.php (action=move/minimize), the ka...

CVE-2012-2936

CVE-2012-2936 affects Pligg CMS prior to 1.2.2. The vulnerability is a set of cross-site scripting (XSS) flaws that allow remote attackers to inject arbitrary script/HTML via: (1) user or (2) page parameters to (a) admin/admin_comments.php or (b) admin/admin_links.php, or the list parameter in a ...

CVE-2012-2937

CVE-2012-2937 affects Pligg CMS, prior to 1.2.2. The vulnerability is multiple SQL injection flaws in the core/admin and module code: (1) list parameter in move action to admin/admin_index.php, (2) display parameter in minimize action to admin/admin_index.php, (3) enabled[] parameter to admin/adm...

PT-2012-4041

Name of the Vulnerable Software and Affected Versions Pligg CMS versions prior to 1.2.2 Description The issue allows remote authenticated users to include and execute arbitrary local files via a .. dot dot in the captcha parameter to "module.php". This can be exploited through cross-site request...

PT-2012-4042

Name of the Vulnerable Software and Affected Versions Pligg CMS versions prior to 1.2.2 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved through various parameters in different modules, including an arbitrary parameter in a move or minimiz...

PT-2012-4378

Name of the Vulnerable Software and Affected Versions Pligg CMS versions prior to 1.2.2 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved through several parameters in different actions and files, including the "list" parameter in a move action ...

PT-2012-4377

Name of the Vulnerable Software and Affected Versions Pligg CMS versions prior to 1.2.2 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the user or page parameter to "admin/admin comments.php" or "admin/admin links.php", or the list...