918 matches found
CVE-2014-5027
Cross-site scripting XSS vulnerability in Review Board 1.7.x before 1.7.27 and 2.0.x before 2.0.4 allows remote attackers to inject arbitrary web script or HTML via a query parameter to a diff fragment page...
CVE-2014-4538
Cross-site scripting XSS vulnerability in process.php in the Malware Finder plugin 1.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the query parameter...
CVE-2014-4538
Cross-site scripting XSS vulnerability in process.php in the Malware Finder plugin 1.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the query parameter...
Tkai's Shoutbox Query Parameter URI Redirection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/12914/info Tkai's Shoutbox is reported prone to a remote URI redirection vulnerability. It is reported that an attacker can exploit this issue by supplying the URI of a malicious site through the 'query' parameter of a...
CVE-2014-4036
Cross-site scripting XSS vulnerability in modules/system/admin.php in ImpressCMS 1.3.6.1 allows remote attackers to inject arbitrary web script or HTML via the query parameter in a listimg action...
CVE-2014-3961
SQL injection vulnerability in the Export CSV page in the Participants Database plugin before 1.5.4.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the query parameter in an "output CSV" action to pdb-signup/...
PT-2014-5637 · WordPress · Participants Database
Name of the Vulnerable Software and Affected Versions: Participants Database plugin versions prior to 1.5.4.9 Description: The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the query parameter in an "output CSV" action to the "pdb-signup/" endpoint...
Cross site scripting
Cross-site scripting XSS vulnerability in the search feature in SeedDMS formerly LetoDMS and MyDMS before 4.3.4 allows remote attackers to inject arbitrary web script or HTML via the query parameter...
Log Analyzer 3.6.0 Cross Site Scripting
Title: ====== Log Analyzer 3.6.0 - Cross Site Scripting Vulnerability Date: ===== 2012-12-20 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=792 Vendor:...
Cross site scripting
Cross-site scripting XSS vulnerability in gb/user/index.php in Ramui Forum, possibly 1.0 Beta, allows remote attackers to inject arbitrary web script or HTML via the query parameter...
CVE-2012-6045
Cross-site scripting XSS vulnerability in gb/user/index.php in Ramui Forum, possibly 1.0 Beta, allows remote attackers to inject arbitrary web script or HTML via the query parameter...
Cross site scripting
Cross-site scripting XSS vulnerability in group/members.php in Mahara 1.5.x before 1.5.7 and 1.6.x before 1.6.2 allows remote attackers to inject arbitrary web script or HTML via the query parameter...
CVE-2012-2253
Cross-site scripting XSS vulnerability in group/members.php in Mahara 1.5.x before 1.5.7 and 1.6.x before 1.6.2 allows remote attackers to inject arbitrary web script or HTML via the query parameter...
CVE-2012-2253
CVE-2012-2253 is a cross-site scripting (XSS) vulnerability in Mahara, specifically in group/members.php. The flaw allows remote attackers to inject arbitrary web script or HTML via a query parameter. Affected versions are Mahara 1.5.x before 1.5.7 and 1.6.x before 1.6.2. The connected documents ...
PHP 5.4.x < 5.4.3 Multiple Vulnerabilities
Binary data 6495.prm...
UBUNTU-CVE-2012-2922
The requestpath function in includes/bootstrap.inc in Drupal 7.14 and earlier allows remote attackers to obtain sensitive information via the q parameter to index.php, which reveals the installation path in an error message...
PHP 5.4.x < 5.4.3 Multiple Vulnerabilities
According to its banner, the version of PHP installed on the remote host is 5.4.x earlier than 5.4.3. It is, therefore, potentially affected the following vulnerabilities : - The fix for CVE-2012-1823 does not completely correct the CGI query parameter vulnerability. Disclosure of PHP source code...
The vulnerability exists in the standalone and also in the online demonstration enviroment.
It is possible to anonymously enumerate all usernames via the script at /rest/prototype/1/search/user.json?max-results=10&query=XX. The 'query' GET parameter should contain at least two charakters. It is possible to enumerate all usernames by performing a search from 'query' value 'aa' to 'zz'...
Code injection
webglimpse.cgi in Webglimpse before 2.20.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the query parameter, as exploited in the wild in March 2012...