Plugin Info Card <= 2.3.6 - Authenticated XSS

Authenticated XSS via wppic-list POST parameter in the wppicwidgetrender AJAX method which is also lacking CSRF and authorisation checks, even in the fixed version...

CVE-2014-9561

Cross-site scripting XSS vulnerability in redirlastpostlist.php in SoftBB 0.1.3 allows remote attackers to inject arbitrary web script or HTML via the post parameter...

CVE-2014-9561: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in redirlastpostlist.php in SoftBB 0.1.3 allows remote attackers to inject arbitrary web script or HTML via the post parameter...

CVE-2014-9560: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in redirlastpostlist.php in SoftBB 0.1.3 allows remote attackers to execute arbitrary SQL commands via the post parameter...

PHPB2B某处sql注入#2

简要描述： PHPB2B某处sql注入2 详细说明： PHPB2B某处sql注入 官网下载的最新版本 绕过全局防注入。 我们先看看全局防注入怎么写的。 以下是全局防注入用到的函数 function pbattackfilter$StrFiltKey,$StrFiltValue,$ArrFiltReq ifisarray$StrFiltValue $StrFiltValue=@implode",", $StrFiltValue; if pregmatch"/".$ArrFiltReq."/is",$StrFiltValue==1 echo $StrFiltValue;...

CVE-2014-8026

Cross-site scripting XSS vulnerability in the Guest Server in Cisco Jabber allows remote attackers to inject arbitrary web script or HTML via a 1 GET or 2 POST parameter, aka Bug ID CSCus08074...

CVE-2014-8026: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Guest Server in Cisco Jabber allows remote attackers to inject arbitrary web script or HTML via a 1 GET or 2 POST parameter, aka Bug ID CSCus08074...

ClipBucket CMS Xss Vulnerability

Xss Vulnerability In ClipBucket CMS @@@ @@@@@@@@@@@ @@@@@ @@@@@@@@@@ @@@ @@@@@@@ @@@ @@@@@@@@@@@ @@@ @@ @@@ @@ @@@ @@@@@@@@ @@@ @@@ @@@ @@ @@@ @@ @@@ @@@ @@@ @@@ @@@ @@@ @@ @@@ @@ @@@ @@@ @@@ @@@ @@@@@@@@@@@ @@@ @ @@@@@@@@@@ @@@ @@@@@@ @@@ @@@@@@@@@@@ @@@ @@ @@@ @@ @@@ @@@@@@ @@@ @@@ @@@ @@ @@@ @...

SQL Injection in Е2

Advisory ID: HTB23222 Product: Е2 Vendor: Ilya Birman Vulnerable Versions: v2844 and probably prior Tested Version: v2844 Advisory Publication: July 2, 2014 without technical details Vendor Notification: July 2, 2014 Vendor Patch: July 3, 2014 Public Disclosure: July 23, 2014 Vulnerability Type:...

[SECURITY] [DLA 68-1] fex security update

Package : fex Version : 20100208+debian1-1+squeeze4 CVE ID : CVE-2014-3875 CVE-2014-3876 CVE-2014-3877 CVE-2014-3875 When inserting encoded newline characters into a request to rup, additional HTTP headers can be injected into the reply, as well as new HTML code on the top of the website...

BSK PDF Manager < 2.9.1 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin does not sanitise the view and cattitle POST parameter when creating or editing a category /wp-admin/admin.php?page=bsk-pdf-manager, allowing authenticated users with a role as low as editor to set an XSS payload which will be triggered in the Categories list...

Hotel Booking Portal - SQL Injection

No description provided by source. 'Hotel Booking Portal' SQL Injection CVE-2012-1672 Mark Stanislav - [email protected] I. DESCRIPTION --------------------------------------- A vulnerability exists in getcity.php that allows for SQL injection of the 'country' POST parameter. II. TESTED...

ZeroCMS 1.0 - (zero_transact_article.php article_id POST parameter) SQL Injection Vulnerability

No description provided by source. ZeroCMS v1.0 SQL Injection Vulnerability zerotransactarticle.php articleid POST parameter Vendor: Another Awesome Stuff Product web page: http://www.aas9.in/zerocms Affected version: 1.0 Severity: High CWE: 89 - http://cwe.mitre.org/data/definitions/89.html CVE:...

ClipBucket CMS Cross Site Scripting

@@@ @@@@@@@@@@@ @@@@@ @@@@@@@@@@ @@@ @@@@@@@ @@@ @@@@@@@@@@@ @@@ @@ @@@ @@ @@@ @@@@@@@@ @@@ @@@ @@@ @@ @@@ @@ @@@ @@@ @@@ @@@ @@@ @@@ @@ @@@ @@ @@@ @@@ @@@ @@@ @@@@@@@@@@@ @@@ @ @@@@@@@@@@ @@@ @@@@@@ @@@ @@@@@@@@@@@ @@@ @@ @@@ @@ @@@ @@@@@@ @@@ @@@ @@@ @@ @@@ @@ @@@ @@@ @@@ @@@ @@@ @@@ @@@ @@ @@@...

Connect &quot;_method&quot;跨站脚本漏洞

Connect是一款基于WEB的应用。 Connect不正确过滤"method" POST参数数据，允许远程攻击者可以利用漏洞构建恶意URI，诱使用户解析，可获得敏感Cookie，劫持会话或在客户端上进行恶意操作。 0 Connect 2.x Connect 2.8.1版本已修复该漏洞，建议用户下载使用： https://github.com/senchalabs/connect...

csChat-R-Box Script Site Cross-Site Scripting Vulnerability

Exploit for cgi platform in category web applications Exploit Title: "csChat-R-Box Script Site" Cross-Site Scripting XSS Google Dork: csChatRBox.cgi Date: 4/10/2014 Exploit Author: Satanic2000 Vendor Homepage: http://www.cgiscript.net Software Link:...

e107 &quot;comment&quot;脚本注入漏洞

e107是一款内容管理系统。 由于通过"comment" POST参数传递到/news.php的输入在返回用户前未能正确过滤，当恶意数据被查看时，攻击者可以利用漏洞在受影响站点上下文的用户浏览器会话中注入并任意HTML和脚本代码。 0 e107 1.0.4 目前厂商暂无提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://e107.org/...

CA 2E Web Option 8.1.2 Privilege Escalation / Denial Of Service

This is a multi-part message in MIME format. ------=NextPart00101CF280B.6C29886A Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Vulnerability title: Unauthenticated Privilege Escalation in CA 2E Web Option CVE: CVE-2014-1219 Vendor: CA Product: 2E Web...

Multiple Vulnerabilities in VideoWhisper Live Streaming Integration WP Plugin

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in VideoWhisper Live Streaming Integration, which can be exploited to execute arbitrary code on the target system, gain access to potentially sensitive data, perform Cross-Site Scripting XSS attacks against users of...

SQL Injection in doorGets CMS

High-Tech Bridge Security Research Lab discovered vulnerability in doorGets CMS, which can be exploited to perform SQL Injection attacks. 1 SQL Injection in doorGets CMS: CVE-2014-1459 The vulnerability exists due to insufficient validation of "positiondownid" HTTP POST parameter passed to...