Jorjweb - 'id' SQL Injection

source: https://www.securityfocus.com/bid/66377/info Jorjweb is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. A successful exploit will allow an attacker to compromise the application, access or modify data, o...

MediaWiki thumb.php 'w' Parameter Remote Shell Command Injection

The version of MediaWiki running on the remote host is affected by a remote command injection vulnerability due to a failure to properly sanitize user-supplied input to the 'w' parameter in the 'thumb.php' script. A remote, unauthenticated attacker can exploit this issue to execute arbitrary...

Singapore 0.9.9b Beta - Image Gallery Remote File Inclusion Cross-Site Scripting

Singapore 0.9.9b Beta - Image Gallery Remote File Inclusion Cross-Site Scripting source: https://www.securityfocus.com/bid/65420/info Singapore Image Gallery is prone to a remote file-include vulnerability and a cross-site scripting vulnerability because the application fails to properly sanitize...

Imageview - upload.php Arbitrary File Upload

Imageview - upload.php Arbitrary File Upload source: https://www.securityfocus.com/bid/65059/info Imageview is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input. An attacker may leverage...

WordPress Plugin Advanced Dewplayer - 'download-file.php' Script Directory Traversal

source: https://www.securityfocus.com/bid/64587/info The Advanced Dewplayer plugin for WordPress is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input. Exploiting this issue can allow an attacker to obtain sensitive information that could ai...

WordPress Plugin Advanced Dewplayer - download-file.php Script Directory Traversal

WordPress Plugin Advanced Dewplayer - download-file.php Script Directory Traversal source: https://www.securityfocus.com/bid/64587/info The Advanced Dewplayer plugin for WordPress is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input...

AFCommerce - 'adminpassword.php' Remote File Inclusion

source: https://www.securityfocus.com/bid/64541/info AFCommerce is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied input. An attacker can exploit these vulnerabilities to obtain potentially sensitive information or to execute arbitrary...

AFCommerce - adminpassword.php Remote File Inclusion

AFCommerce - adminpassword.php Remote File Inclusion source: https://www.securityfocus.com/bid/64541/info AFCommerce is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied input. An attacker can exploit these vulnerabilities to obtain...

AFCommerce - controlheader.php Remote File Inclusion

AFCommerce - controlheader.php Remote File Inclusion source: https://www.securityfocus.com/bid/64541/info AFCommerce is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied input. An attacker can exploit these vulnerabilities to obtain...

AFCommerce - 'controlheader.php' Remote File Inclusion

source: https://www.securityfocus.com/bid/64541/info AFCommerce is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied input. An attacker can exploit these vulnerabilities to obtain potentially sensitive information or to execute arbitrary...

xBoard 5.05.56.0 - view.php Local File Inclusion

xBoard 5.05.56.0 - view.php Local File Inclusion source: https://www.securityfocus.com/bid/64619/info xBoard is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability to obtain potentially sensitive...

xBoard 5.0/5.5/6.0 - 'view.php' Local File Inclusion

source: https://www.securityfocus.com/bid/64619/info xBoard is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability to obtain potentially sensitive information and execute arbitrary local scripts. This...

iScripts AutoHoster - 'main_smtp.php' Traversal

source: https://www.securityfocus.com/bid/64377/info iScripts AutoHoster is prone to multiple security vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker can exploit these vulnerabilities to compromise the application, access or modify data, or exploit laten...

eduTrac - showmask Directory Traversal

eduTrac - showmask Directory Traversal source: https://www.securityfocus.com/bid/64255/info eduTrac is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input. A remote attacker could exploit the vulnerability using directory-traversal characters '.....

Veno File Manager - 'q' Arbitrary File Download

source: https://www.securityfocus.com/bid/64346/info Veno File Manager is prone to a vulnerability that lets attackers download arbitrary files because the application fails to sufficiently sanitize user-supplied input. An attacker can exploit this issue to download arbitrary files within the...

WordPress Plugin Easy Career Openings - jobid SQL Injection

WordPress Plugin Easy Career Openings - jobid SQL Injection source: https://www.securityfocus.com/bid/64167/info WordPress Easy Career Openings plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL...

RomPager HTTP Referer Header XSS

The remote RomPager HTTP server is affected by a cross-site scripting vulnerability. The server does not properly sanitize the referer header value when generating a 404 error page. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

WordPress Theme Suco - themify-ajax.php Arbitrary File Upload

WordPress Theme Suco - themify-ajax.php Arbitrary File Upload source: https://www.securityfocus.com/bid/63836/info The Suco themes for WordPress is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize...

Updated roundcubemail package fixes security vulnerability

It was discovered that roundcube does not properly sanitize the session parameter in steps/utils/savepref.inc during saving preferences. The vulnerability can be exploited to overwrite configuration settings and subsequently allowing random file access, manipulated SQL queries and even code...

Limonade Framework - 'limonade.php' Local File Disclosure

source: https://www.securityfocus.com/bid/63771/info Limonade framework is prone to a local file-disclosure vulnerability because it fails to sanitize user-supplied input. An attacker may leverage this issue to obtain sensitive information from local files on computers running the vulnerable...