CVE-2017-1002026

The CVE-2017-1002026 entry concerns the WordPress plugin Event Espresso Free (v3.1.37.11.L). The root cause is failure to sanitize the user-supplied input in the edit_event_category function via the $id parameter before it is used in an SQL statement, enabling a SQL injection. Documented impact i...

CVE-2017-11761

Microsoft Exchange Server 2013 and Microsoft Exchange Server 2016 allow an input sanitization issue with Microsoft Exchange that could potentially result in unintended Information Disclosure, aka "Microsoft Exchange Information Disclosure Vulnerability"...

SolarWinds Orion IP Address Manager (IPAM) 'search.aspx' Cross Site Scripting Vulnerability

CVE-2012-4939SolarWinds Orion IP Address Manager IPAM is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affect...

up.time 7.5.0 - Arbitrary File Disclose and Delete

up.time 7.5.0 Arbitrary File Disclose And Delete Exploit Vendor: Idera Inc. Product web page: http://www.uptimesoftware.com Affected version: 7.5.0 build 16 and 7.4.0 build 13 Summary: The next-generation of IT monitoring software. Desc: Input passed to the 'filename' parameter in 'get2post.php'...

Conxint FTP 2.2.603 Multiple Directory Traversal Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/21081/info Conxint is prone to multiple directory-traversal vulnerabilities because the application fails to sufficiently sanitize user-supplied data. Exploiting these issues may allow a remote attacker to access any file...

PhpWebGallery 1.4.1 category.php Multiple Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/17421/info PHPWebGallery is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage these issues to...

Utopia News Pro 1.1.3 footer.php Multiple Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/15027/info Utopia News Pro is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage these issues to...

WordPress Plugin Simple:Press Forum - Arbitrary File Upload

WordPress Plugin Simple:Press Forum - Arbitrary File Upload source: https://www.securityfocus.com/bid/55243/info The Simple:Press Forum plugin is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplie...

Raven 1.0 - connector.asp Arbitrary File Upload

Raven 1.0 - connector.asp Arbitrary File Upload source: https://www.securityfocus.com/bid/51631/info Raven is prone to a vulnerability that lets an attacker upload and execute arbitrary script code in the context of the affected webserver process. The issue occurs because the application fails to...

CS Whois Lookup RCE Vulnerability (Apr 2009) - Active Check

CS Whois Lookup and CS DNS Lookup are prone to a remote command execution RCE vulnerability because the software fails to adequately sanitize user-supplied input. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by...

Cross site scripting

Cross-site scripting XSS vulnerability in SonicWall Email Security 6.1.1 allows remote attackers to inject arbitrary web script or HTML via the Host header in a request to a non-existent web page, which is not properly sanitized in an error page...

Magic Photo Storage Website - '/user/delete_category.php?_config[site_path]' Remote File Inclusion

source: https://www.securityfocus.com/bid/21965/info Magic Photo Storage Website is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues may allow an attacker to compromise the application and the underlying...

PHPSelect Web Development - index.php3 Remote File Inclusion

PHPSelect Web Development - index.php3 Remote File Inclusion source: https://www.securityfocus.com/bid/20231/info PHPSelect Web Development is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input. A successful exploit of this issue allows an...

ToendaCMS 0.7 - index.php Cross-Site Scripting

ToendaCMS 0.7 - index.php Cross-Site Scripting source: https://www.securityfocus.com/bid/18178/info ToendaCMS is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to have...

SimpleBBS 1.0.6/1.0.7/1.1 - Arbitrary Command Execution

source: https://www.securityfocus.com/bid/17501/info SimpleBBS is prone to an arbitrary command-execution vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit this vulnerability to execute arbitrary PHP commands in the...

[eVuln] CyBoards PHP Lite SQL Injection Vulnerability

New eVuln Advisory: CyBoards PHP Lite SQL Injection Vulnerability http://evuln.com/vulns/91/summary.html --------------------Summary---------------- eVuln ID: EV0091 CVE: CVE-2006-1134 Software: CyBoards PHP Lite Sowtware's Web Site:...

PHPWebGallery 1.3.41.5.1 - category.php SQL Injection

PHPWebGallery 1.3.41.5.1 - category.php SQL Injection source: https://www.securityfocus.com/bid/15837/info PhpWebGallery is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in SQL queries. A successful exploit...

1-Script 1-Search 1.8 - '1search.CGI' Cross-Site Scripting

source: https://www.securityfocus.com/bid/15712/info 1-Search is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code executed in the browser of ...

HelpDeskPoint Free Help Desk Software SQL inj.

HelpDeskPoint Free Help Desk Software SQL inj. Vuln. dicovered by : r0t Date: 25 nov. 2005 Orginal advisory:http://pridels.blogspot.com/2005/11/helpdeskpoint-free-help-desk-software.html Vendor:http://helpdeskpoint.com affected version: 2.38 and prior Product Description: HelpDeskPoint.com Welcom...

Widget Property 1.1.19 - Property.php SQL Injection

Widget Property 1.1.19 - Property.php SQL Injection source: https://www.securityfocus.com/bid/15701/info Widget Press Widget Property is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input to the 'property.php' script...