CVE-2012-4998: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in starCMS allows remote attackers to inject arbitrary web script or HTML via the q parameter...

PT-2012-5716

Name of the Vulnerable Software and Affected Versions starCMS affected versions not specified Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the q parameter in the "index.php" file...

PT-2012-2153 · Unknown · Banana Dance

Name of the Vulnerable Software and Affected Versions: Banana Dance versions prior to B.1.5 Description: The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the q or category parameters in th...

CVE-2011-5176: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in search.php in Banana Dance, possibly B.1.5 and earlier, allow remote attackers to inject arbitrary web script or HTML via the 1 q or 2 category parameter...

CVE-2012-2069

Cross-site request forgery CSRF vulnerability in the Wishlist module 6.x-2.x before 6.x-2.6 and 7.x-2.x before 7.x-2.6 for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that insert cross-site scripting XSS sequences via the 1 wlreveal or 2 q parameter...

PT-2012-3783

Name of the Vulnerable Software and Affected Versions Drupal Wishlist module versions 6.x-2.x before 6.x-2.6 Drupal Wishlist module versions 7.x-2.x before 7.x-2.6 Description A cross-site request forgery CSRF issue exists, allowing remote attackers to hijack user authentication for requests that...

CVE-2012-2069: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the Wishlist module 6.x-2.x before 6.x-2.6 and 7.x-2.x before 7.x-2.6 for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that insert cross-site scripting XSS sequences via the 1 wlreveal or 2 q parameter...

PT-2012-3778

Name of the Vulnerable Software and Affected Versions Views Language Switcher module version 7.x-1.1 and earlier Description A cross-site scripting issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the q parameter in the theme/views lang...

CVE-2012-2064

Cross-site scripting XSS vulnerability in theme/viewslangswitch.theme.inc in the Views Language Switcher module before 7.x-1.2 for Drupal allows remote attackers to inject arbitrary web script or HTML via the q parameter...

CVE-2012-2064

Cross-site scripting XSS vulnerability in theme/viewslangswitch.theme.inc in the Views Language Switcher module before 7.x-1.2 for Drupal allows remote attackers to inject arbitrary web script or HTML via the q parameter...

CVE-2012-2064: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in theme/viewslangswitch.theme.inc in the Views Language Switcher module before 7.x-1.2 for Drupal allows remote attackers to inject arbitrary web script or HTML via the q parameter...

CVE-2012-2083: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the fusioncorepreprocesspage function in fusioncore/template.php in the Fusion module before 6.x-1.13 for Drupal allows remote attackers to inject arbitrary web script or HTML via the q parameter...

PT-2012-3795

Name of the Vulnerable Software and Affected Versions Fusion module versions prior to 6.x-1.13 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the q parameter. Recommendations For...

PT-2012-4395

Name of the Vulnerable Software and Affected Versions Plixer Scrutinizer versions prior to 9.5.2 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the q parameter in the d4d/statusFilter.php file. Recommendations For versions prior to...

CVE-2012-2962: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer aka Dell SonicWALL Scrutinizer before 9.5.2 allows remote authenticated users to execute arbitrary SQL commands via the q parameter...

CVE-2012-3391

mod/forum/rsslib.php in Moodle 2.1.x before 2.1.7 and 2.2.x before 2.2.4 does not properly implement the requirement for posting before reading a Q&A forum, which allows remote authenticated users to bypass intended access restrictions by leveraging the student role and reading the RSS feed for a...

PT-2012-4684

Name of the Vulnerable Software and Affected Versions Moodle versions 2.1.x through 2.1.6 Moodle versions 2.2.x through 2.2.3 Description The issue concerns the improper implementation of access restrictions in a Q&A forum, allowing remote authenticated users with the student role to bypass...

Dell SonicWALL Scrutinizer 9.0.1 (statusFilter.php q parameter) SQL Injection

Exploit for php platform in category web applications !/usr/bin/python Exploit Title: Dell SonicWALL Scrutinizer 9.0.1 statusFilter.php q parameter SQL Injection Date: Jul 22 2012 Author: muts Version: SonicWALL Scrutinizer 9.0.1 Vendor URL: http://www.sonicwall.com Special thanks to: Tal Zeltzer...

CVE-2010-2021

Open redirect vulnerability in the Global Redirect module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.4 for Drupal, when non-clean to clean is enabled, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the q parameter...

CVE-2010-2021

Open redirect vulnerability in the Global Redirect module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.4 for Drupal, when non-clean to clean is enabled, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the q parameter...