CVE-2016-10105

admin/plugin.php in Piwigo through 2.8.3 doesn't validate the sections variable while using it to include files. This can cause information disclosure and code execution if it contains a .. sequence...

CVE-2016-10105: Exposure of Sensitive Information to an Unauthorized Actor

admin/plugin.php in Piwigo through 2.8.3 doesn't validate the sections variable while using it to include files. This can cause information disclosure and code execution if it contains a .. sequence...

CVE-2016-10083

CVE-2016-10083 affects Piwigo (admin/plugin.php) up to version 2.8.3. The vulnerability is a Cross-site Scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML via a crafted filename that is mishandled in a specific error case. The public records in the connected ...

CVE-2016-10083: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/plugin.php in Piwigo through 2.8.3 allows remote attackers to inject arbitrary web script or HTML via a crafted filename that is mishandled in a certain error case...

CVE-2014-4557: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in test-plugin.php in the Swipe Checkout for Jigoshop swipe-hq-checkout-for-jigoshop plugin 3.1.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the apiurl parameter...

CVE-2014-4556: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in test-plugin.php in the Swipe Checkout for eShop plugin 3.7.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the apiurl parameter...

WooCommerce Swipe <= 2.7.1 - Unauthenticated Reflected XSS

The last time it was checked the plugin was still affected and had been closed. http://www.example.com/wp-content/plugins/swipehq–payment–gateway–woocommerce/test-plugin.php?apiurl=apiurl%27%3E%3Cscript%3Ealert%284%29%3C/script%3E...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in wlcms-plugin.php in the White Label CMS plugin before 1.5.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that modify the developer name via the wlcmsodevelopername parameter in a save action to...

CVE-2012-5388

CVE-2012-5388 is an XSS vulnerability in the White Label CMS plugin for WordPress (wlcms-plugin.php) version 1.5. It allows remote authenticated administrators to inject arbitrary web script or HTML via the wlcms_o_developer_name parameter during a save action to wp-admin/admin.php. This is relat...

CVE-2012-5388: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in wlcms-plugin.php in the White Label CMS plugin 1.5 for WordPress allows remote authenticated administrators to inject arbitrary web script or HTML via the wlcmsodevelopername parameter in a save action to wp-admin/admin.php, a related issue to CVE-2012-53...

WordPress White Label CMS Plugin <= 1.5 - XSS

Because of this vulnerability in wlcms-plugin.php, the authenticated administrators can inject arbitrary web script or HTML via the "wlcmsodevelopername" parameter. Solution Update the plugin...

Membris v 2.0.1 Sql \ XSS & File Disclosure Vulnerabilities

Exploit for php platform in category web applications Exploit:Membris v 2.0.1 Sql \ XSS & File Disclosure Vulnerabilities Google Dork: Powered by Membris v 2.0.1 Date: Dr.abolalh Author:01/06/2012 E-Mail: email protected Software Link: http://scripts.toocharger.com/fiches/scripts/membris/5258.htm...

CVE-2012-1039: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Dotclear before 2.4.2 allow remote attackers to inject arbitrary web script or HTML via the 1 logindata parameter to admin/auth.php; 2 nb parameter to admin/blogs.php; 3 type, 4 sortby, 5 order, or 6 status parameters to admin/comments.php; or ...

PHPCMS V9 (plugin.php)本地文件包含漏洞

由于文件/plugin.php对于用户提交的变量未过滤，导致本地文件包含漏洞的产生。 相关代码如下： 文件plugin.php ifisset$GET'id' list$identification, $filename,$action = explode'-', $GET'id'; $filename = !empty$filename ? $filename : $identification; $action = !empty$action ? $action : 'init'; $cache = getcache$identification,'plugins';...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in configdefaultsinc.php in MantisBT before 1.2.8 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO, as demonstrated by the PATHINFO to 1 manageconfigemailpage.php, 2 manageconfigworkflowpage.php, or 3 bugs/plugin.php...

CVE-2011-3356

Multiple cross-site scripting XSS vulnerabilities in configdefaultsinc.php in MantisBT before 1.2.8 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO, as demonstrated by the PATHINFO to 1 manageconfigemailpage.php, 2 manageconfigworkflowpage.php, or 3 bugs/plugin.php...

CVE-2009-3185: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in plugin.php in the Crazy Star plugin 2.0 for Discuz! allows remote authenticated users to execute arbitrary SQL commands via the fmid parameter in a view action...

CVE-2009-1502

CVE-2009-1502 affects S-Cms versions 1.1 Stable and 1.5.2, where the plugin.php page parameter is vulnerable to directory traversal, allowing remote attackers to include and execute arbitrary local files. The vulnerability stems from improper handling of directory traversal sequences, enabling un...

CVE-2009-1502: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in plugin.php in S-Cms 1.1 Stable and 1.5.2 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the page parameter...

S-CMS version 1.1 suffers from a local file inclusion vulnerability in plugin.php

s-cms/plugin.php code: $page=$GET'page'; error 1 $sqlselectplugincase= mysqlquery"SELECT FROM ".$prefix."plugins WHERE active = '1' AND file='$page'"; if $sqlselectplugincase include "plugins/$page"; error 2 S-CMS version 1.1 暂无 yildirimordulari.com/s-cms/plugin.php?page=File for demo:...