Cross site scripting

Cross-site scripting XSS vulnerability in manager/xmedia.php in Plume CMS 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the dir parameter...

CVE-2008-1048

Cross-site scripting XSS vulnerability in manager/xmedia.php in Plume CMS 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the dir parameter...

CVE-2008-1048

The CVE-2008-1048 entry describes a Cross-site scripting (XSS) vulnerability in Plume CMS 1.2.2, specifically in manager/xmedia.php where the dir parameter can be exploited to inject arbitrary web script or HTML. Affected software: Plume CMS 1.2.2 (component: manager/xmedia.php). Underlying cause...

Plume CMS 1.2.2 - managerxmedia.php Cross-Site Scripting

Plume CMS 1.2.2 - managerxmedia.php Cross-Site Scripting source: https://www.securityfocus.com/bid/27999/info Plume CMS is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data. An attacker may leverage this issue to execute arbitrary...

Plume CMS 1.2.2 - '/manager/xmedia.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/27999/info Plume CMS is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the...

Plume CMS 1.0.4 - 'index.php?_PX_config[manager_path]' Remote File Inclusion

source: https://www.securityfocus.com/bid/18780/info Plume CMS is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input. A successful exploit of these issues allows the attacker to execute arbitrary server-side script code on an affected...

Plume CMS 1.0.4 - index.php?_PX_config[manager_path] Remote File Inclusion

Plume CMS 1.0.4 - index.php?PXconfigmanagerpath Remote File Inclusion source: https://www.securityfocus.com/bid/18780/info Plume CMS is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input. A successful exploit of these issues allows the...

Plume CMS 1.0.4 - rss.php?_PX_config[manager_path] Remote File Inclusion

Plume CMS 1.0.4 - rss.php?PXconfigmanagerpath Remote File Inclusion source: https://www.securityfocus.com/bid/18780/info Plume CMS is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input. A successful exploit of these issues allows the...

Plume CMS 1.0.4 - 'rss.php?_PX_config[manager_path]' Remote File Inclusion

source: https://www.securityfocus.com/bid/18780/info Plume CMS is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input. A successful exploit of these issues allows the attacker to execute arbitrary server-side script code on an affected...

CVE-2006-7021

PHP remote file inclusion vulnerability in manager/tools/link/dbinstall.php in Plume CMS 1.1.3 allows remote attackers to execute arbitrary PHP code via a URL in the PXconfigmanagerpath parameter...

CVE-2006-7021

PHP remote file inclusion vulnerability in manager/tools/link/dbinstall.php in Plume CMS 1.1.3 allows remote attackers to execute arbitrary PHP code via a URL in the PXconfigmanagerpath parameter...

CVE-2006-7021

The CVE-2006-7021 entry concerns a PHP remote file inclusion in Plume CMS 1.1.3. Specifically, dbinstall.php under manager/tools/link accepts a URL via the _PX_config[manager_path] parameter, allowing an attacker to execute arbitrary PHP code remotely. Affected software: Plume CMS 1.1.3; vulnerab...

Plume CMS远程文件包含漏洞

Plume CMS是一款基于PHP的内容管理程序。 Plume CMS不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是多个脚本对用户提交的WEB参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 Plume CMS Plume CMS 1.0.6 Plume CMS Plume CMS 1.0.4 http://www.plume-cms.net/...

PlumeCMS_1.1.10.txt

Vendor: Plume CMS 1.1.10 Found By : D3nGeR Scripit Site : http://plume-cms.net in file prepend.php ; includeonce $PXconfig'managerpath'.'/inc/class.config.php' code http://site.com/pathmanager/frontinc/prepend.php?PXconfigmanagerpath=shell code...

Plume CMS <= 1.1.10 [prepend.php] Remote File Include Vulnerability

Vendor: Plume CMS 1.1.10 Found By : D3nGeR Scripit Site : http://plume-cms.net in file prepend.php ; includeonce $PXconfig'managerpath'.'/inc/class.config.php' code http://site.com/pathmanager/frontinc/prepend.php?PXconfigmanagerpath=shell code...

CVE-2006-4533

Multiple PHP remote file inclusion vulnerabilities in Plume CMS 1.0.6 and earlier allow remote attackers to execute arbitrary PHP code via the PXconfigmanagerpath parameter to 1 articles.php, 2 categories.php, 3 news.php, 4 prefs.php, 5 sites.php, 6 subtypes.php, 7 users.php, 8 xmedia.php, 9...

CVE-2006-4533

Multiple PHP remote file inclusion vulnerabilities in Plume CMS 1.0.6 and earlier allow remote attackers to execute arbitrary PHP code via the PXconfigmanagerpath parameter to 1 articles.php, 2 categories.php, 3 news.php, 4 prefs.php, 5 sites.php, 6 subtypes.php, 7 users.php, 8 xmedia.php, 9...

CVE-2006-4533

CVE-2006-4533 : Plume CMS versions 1.0.6 and earlier are affected by multiple PHP remote file inclusion vulnerabilities. The flaw allows remote attackers to execute arbitrary PHP code by supplying a crafted value to the _PX_config[manager_path] parameter in 13 vulnerable scripts (articles.php, ca...

plume-1.0.6.txt

Plume CMS Multiple Remote File Include Vulnerabilities Vulnerable Versions: Plume CMS = 1.0.6 Vendor: Plume CMS http://plume-cms.net -Vulnerable Code include $PXconfig'managerpath'.'/directory/file.php'; -Files Affected ./articles.php ./categories.php ./index.php ./news.php ./prefs.php ./sites.ph...

CVE-2006-3562

PHP remote file inclusion vulnerabilities in plume cms 1.0.4 allow remote attackers to execute arbitrary PHP code via a URL in the PXconfigmanagerpath parameter to 1 index.php, 2 rss.php, or 3 search.php, a different set of vectors and versions than CVE-2006-2645 and CVE-2006-0725...