FreeSMS - '/pages/crc_handler.php?scheduleid' SQL Injection

source: https://www.securityfocus.com/bid/63004/info FreeSMS is prone to multiple cross-site scripting vulnerabilities and an SQL-injection vulnerability because it fails to properly sanitize user-supplied input. Attackers can exploit these issues to execute arbitrary code in the context of the...

OTRS Mailbox HTML Injection Vulnerability (OSA-2007-01)

Open Ticket Request System OTRS is prone to a HTML injection vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Moodle 'external.php' 'badge' Parameter XSS

The version of Moodle installed on the remote host fails to properly sanitize user-supplied input to the 'badge' parameter of the 'external.php' script. The application also fails to properly sanitize serialized objects. An attacker can exploit these issues by crafting a URL containing a serializ...

WordPress Plugin mukioplayer4wp - cid SQL Injection

WordPress Plugin mukioplayer4wp - cid SQL Injection source: https://www.securityfocus.com/bid/62438/info mukioplayer4wp for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue coul...

WordPress Plugin mukioplayer4wp - 'cid' SQL Injection

source: https://www.securityfocus.com/bid/62438/info mukioplayer4wp for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application,...

Joomla com_sectionex v2.5.96 SQL Injection vulnerabilities

------------------------------------------------------------------------------------- Joomla comsectionex v2.5.96 SQL Injection vulnerabilities ------------------------------------------------------------------------------------- == Description == - Software link: http://stackideas.com/sectionex ...

Amazon Linux AMI : busybox (ALAS-2012-103)

A buffer underflow flaw was found in the way the uncompress utility of BusyBox expanded certain archive files compressed using Lempel-Ziv compression. If a user were tricked into expanding a specially crafted archive file with uncompress, it could cause BusyBox to crash or, potentially, execute...

fog-dragonfly Gem for Ruby imagemagickutils.rb Remote Command Execution

fog-dragonfly Gem for Ruby contains a flaw that is due to the program failing to properly sanitize input passed via the imagemagickutils.rb script. This may allow a remote attacker to execute arbitrary commands...

Xibo - 'layout' HTML Injection

source: https://www.securityfocus.com/bid/62063/info Xibo is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input. Attacker-supplied HTML and script code could be executed in the context of the affected site, potentially allowing the attacker to steal...

Xibo - layout HTML Injection

Xibo - layout HTML Injection source: https://www.securityfocus.com/bid/62063/info Xibo is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input. Attacker-supplied HTML and script code could be executed in the context of the affected site, potentially...

CakePHP 2.2.8/2.3.7 - AssetDispatcher Class Local File Inclusion

source: https://www.securityfocus.com/bid/61746/info CakePHP is prone to a local file-include vulnerability because it fails to sufficiently sanitize user-supplied input. An attacker can exploit this vulnerability to view files or execute arbitrary script code in the context of the web server...

DotNetNuke 6.1.x - Cross-Site Scripting

DotNetNuke 6.1.x - Cross-Site Scripting source: https://www.securityfocus.com/bid/61770/info DotNetNuke is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser o...

DotNetNuke 6.1.x - Cross-Site Scripting

source: https://www.securityfocus.com/bid/61770/info DotNetNuke is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of...

Jahia xCM - administration Multiple Cross-Site Scripting Vulnerabilities

Jahia xCM - administration Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/61571/info Jahia xCM is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied data. An attacker could exploit...

FluxBB 1.5.3 - Multiple Vulnerabilities

F...

WordPress Plugin Duplicator - Cross-Site Scripting

WordPress Plugin Duplicator - Cross-Site Scripting source: https://www.securityfocus.com/bid/61425/info The Duplicator plugin for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute...

vBulletin 4.0.2 - update_order SQL Injection

vBulletin 4.0.2 - updateorder SQL Injection source: https://www.securityfocus.com/bid/61449/info VBulletin is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. A successful exploit may allow an attacker to...

Magnolia CMS - Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/61423/info Magnolia CMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in t...

WordPress Plugin Duplicator - Cross-Site Scripting

source: https://www.securityfocus.com/bid/61425/info The Duplicator plugin for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecti...

VLC Web Interface XML Services XSS

The VLC media player install on the remote host is affected by a cross-site scripting vulnerability because it fails to sanitize input passed via XML services in the web interface. Note that the install is likely to be affected by additional vulnerabilities as well, although Nessus has not tested...