PHPList 2.10.9 'Sajax.php' PHP代码注入漏洞

phplist是一个开源的newsletter管理软件，用PHP开发。 PHPList 'Sajax.php'不正确处理用户提交的数据，远程攻击者可以利用漏洞提交恶意代码，并以WEB权限执行。 0 PHPList 2.10.9 厂商解决方案 phplist ----- 目前没有详细解决方案提供： http://www.phplist.com/ --------------------------------------- This PoC was written for educational purpose. Use it at your own risk. Author will b...

Hastymail "rs"和"rsargs[]"参数远程代码注入漏洞

BUGTRAQ ID: 50794 CVE ID: CVE-2011-4542 Hastymail是一个用PHP编写的快速、安全、兼容RFC、跨平台的IMAP/SMTP客户端应用程序。 Hastymail实现上存在输入验证漏洞，篡改后的$POST'rs'和$POST'rsargs'输入参数没有被正确检查过滤，攻击者可利用这些漏洞注入和执行任意代码，导致Web服务器执行任意PHP代码、泄露敏感信息、删除任意文件。 Hastymail 厂商补丁： Hastymail --------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...

Hastymail 'rs' and 'rsargs[]' Parameters Remote Code Injection Vulnerabilities

The host is running Hastymail2 and is prone to remote code injection vulnerabilities. OpenVAS Vulnerability Test $Id: secpodhastymail2rsparamremotecodeinjvuln.nasl 7006 2017-08-25 11:51:20Z teissa $ Hastymail 'rs' and 'rsargs' Parameters Remote Code Injection Vulnerabilities Authors: Sooraj KS...

Unfixed XSS vulnerability at rs-code.com

Security researcher hexon, has submitted on 19/11/2010 a cross-site-scripting XSS vulnerability affecting rs-code.com, which at the time of submission ranked 2133539 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 28/12/2011. It is currently...

WordPress cformsII plugin rs and rsargs parameters to a script injection vulnerability and fix-vulnerability warning-the black bar safety net

Affected version: Nicole Stich cformsII 11.5 Vulnerability description: WordPress is a Free Forum Blog system. WordPress using cformsII plugin does not properly filter user submitted to the wp-content/plugins/cforms /libajax. php page of the rs and rsargs parameters will be displayed to the user...

Cforms <= 13.1 - 'lib_ajax.php' Cross-Site Scripting (XSS)

The cforms plugin has a XSS vulnerability in file libajax.php with rs and rsargs parameters. It is fixed in version 13.2. The cforms2 fork was forked at 14.6, so it is not affected...

Joomla! Component com_qcontacts - SQL Injection

Exploit Title: Joomla Component QContacts comqcontacts - SQL Injection Vulnerability Date: 12, July 2010 Author: mlk Software Link: http://bugsec.googlecode.com/files/Joomlacomqcontacts.zip Version: 1.0.4 and previous Tested on: all OS CVE : 0 Code : here Joomla Component QContacts comqcontacts -...

Joomla ChronoForms Blind SQL Injection

Exploit Title: Joomla Component ChronoForms comchronocontact Date: 01, June 2010 Author: mlk Renan Software Link:0 Version: 0 Tested on: all OS CVE : 0 Code : here Joomla Component ChronoForms comchronocontact - Blind SQL Injection Vulnerability ! Discovered by : mlk Renan ! Teams : c00kies ,...

Authentication flaw

userHandler.cgi in RaidSonic ICY BOX NAS firmware 2.3.2.IB.2.RS.1 allows remote attackers to bypass authentication and gain administrator privileges by setting the login parameter to admin. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

CVE-2008-7081

userHandler.cgi in RaidSonic ICY BOX NAS firmware 2.3.2.IB.2.RS.1 allows remote attackers to bypass authentication and gain administrator privileges by setting the login parameter to admin. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

CVE-2009-2209

SQL injection vulnerability in rscmsmodnewsview.php in RS-CMS 2.1 allows remote attackers to execute arbitrary SQL commands via the key parameter...

CVE-2009-2209

SQL injection vulnerability in rscmsmodnewsview.php in RS-CMS 2.1 allows remote attackers to execute arbitrary SQL commands via the key parameter...

Sql injection

SQL injection vulnerability in rscmsmodnewsview.php in RS-CMS 2.1 allows remote attackers to execute arbitrary SQL commands via the key parameter...

CVE-2009-2209

CVE-2009-2209 affects RS-CMS 2.1, with the vulnerability located in the file rscms_mod_newsview.php. The issue is an SQL injection via the key parameter, enabling remote attackers to execute arbitrary SQL commands. This vulnerability is classified as high severity (CVSS v2 base score 7.5) with ne...

RS-CMS 2.1 SQL Injection

======================================================= +++++++++++++++++++ information +++++++++++++++++++++++ ======================================================= + Script :RS-CMS 2.1 rscmsmodnewsview.php key Remote SQL Injection Vulnerability + Found by : Mr.tro0oqy + C0ntact :...

RS-CMS 2.1 (key) Remote SQL Injection Vulnerability

No description provided by source. ======================================================= +++++++++++++++++++ information +++++++++++++++++++++++ ======================================================= + Script :RS-CMS 2.1 rscmsmodnewsview.php key Remote SQL Injection Vulnerability + Found by :...

RS-CMS 2.1 (key) Remote SQL Injection Vulnerability

Exploit for unknown platform in category web applications =================================================== RS-CMS 2.1 key Remote SQL Injection Vulnerability =================================================== ======================================================= +++++++++++++++++++ informati...

RS-CMS 2.1 - key SQL Injection

RS-CMS 2.1 - key SQL Injection ======================================================= +++++++++++++++++++ information +++++++++++++++++++++++ ======================================================= + Script :RS-CMS 2.1 rscmsmodnewsview.php key Remote SQL Injection Vulnerability + Found by :...

RS-CMS 2.1 - 'key' SQL Injection

======================================================= +++++++++++++++++++ information +++++++++++++++++++++++ ======================================================= + Script :RS-CMS 2.1 rscmsmodnewsview.php key Remote SQL Injection Vulnerability + Found by : Mr.tro0oqy + C0ntact :...

CVE-2008-4912

SQL injection vulnerability in popupimg.php in the fotogalerie module in RS MAXSOFT allows remote attackers to execute arbitrary SQL commands via the fotoID parameter. NOTE: this issue was disclosed by an unreliable researcher, so it might be incorrect...