CometChat RCE and XSS Vulnerabilities

CometChat is prone to a cross-site scripting XSS vulnerability and a remote code execution RCE vulnerability because the application fails to sufficiently sanitize user-supplied data. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, an...

Piwigo <= 2.4.6 Arbitrary File Disclosure and Arbitrary File Deletion Vulnerabilities

Piwigo is prone to an arbitrary file-disclosure vulnerability and an arbitrary file-deletion vulnerability because the application fails to sanitize user-supplied input. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyrigh...

WP Symposium Plugin for WordPress 'symposium_groups_functions.php' 'gid' Parameter SQL Injection

The WordPress WP Symposium Plugin installed on the remote host is affected by a SQL injection vulnerability due to a failure to properly sanitize user-supplied input to the 'gid' parameter of the 'symposiumgroupsfunctions.php' script. An unauthenticated, remote attacker can leverage this issue to...

Bugzilla show_bug.cgi id Parameter XSS

The version of Bugzilla installed on the remote host is affected by a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input to the 'id' parameter of the 'showbug.cgi' script. An attacker may be able to leverage this to inject arbitrary HTML and script code...

WordPress Plugin Smart Flv - jwplayer.swf Multiple Cross-Site Scripting Vulnerabilities

WordPress Plugin Smart Flv - jwplayer.swf Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/58135/info The Smart Flv plugin for WordPress is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An...

WordPress Plugin Smart Flv - 'jwplayer.swf' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/58135/info The Smart Flv plugin for WordPress is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an...

OpenEMR - site Cross-Site Scripting

OpenEMR - site Cross-Site Scripting source: https://www.securityfocus.com/bid/58085/info OpenEMR is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an...

Alt-N MDaemon 12.5.613.0.3 - Email Body HTMLJS Injection

Alt-N MDaemon 12.5.613.0.3 - Email Body HTMLJS Injection ============================================================== Alt-N MDaemon Email Body HTML/JS Injection Vulnerability ============================================================== Software: Alt-N MDaemon v13.0.3 and prior versions Vendor...

Squirrelcart 3.5.4 Cross Site Scripting

Squirrelcart v3.5.4 table Remote Cross-Site Scripting Vulnerability Vendor: Lighthouse Development Product web page: http://www.squirrelcart.com Affected version: v2.0.0 - 3.5.4 Summary: Squirrelcart PHP Shopping Cart software is a fully customizable, robust php shopping cart, designed with the...

WordPress Plugin Pretty Link - Cross-Site Scripting

source: https://www.securityfocus.com/bid/58072/info The Pretty Link plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an...

CKEditor - posteddata.php Cross-Site Scripting

CKEditor - posteddata.php Cross-Site Scripting source: https://www.securityfocus.com/bid/58045/info CKEditor is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the...

Paypal Marketing Cross Site Scripting

--- Vulnerability No- 1: +URL: https://www.paypal-marketing.com.hk/merchant-enquiries/index.php +Vulnerability Type: Cross Site Scripting XSS + Form Action : POST +POST Data Sent to Produce the Bug :...

WordPress Theme Pinboard - 'tab' Cross-Site Scripting

source: https://www.securityfocus.com/bid/57873/info The Pinboard theme for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting...

LogAnalyzer userchange.php 'viewid' Parameter XSS

The LogAnalyzer install hosted on the remote web server is affected by a cross-site scripting vulnerability due to a failure to properly sanitize user input to the 'viewid' parameter of the 'userchange.php' script. An attacker can exploit this issue to inject arbitrary HTML and script code into a...

WordPress Plugin CommentLuv - _ajax_nonce Cross-Site Scripting

WordPress Plugin CommentLuv - ajaxnonce Cross-Site Scripting source: https://www.securityfocus.com/bid/57771/info The CommentLuv plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue...

ezStats2 - 'style.php' Local File Inclusion

source: https://www.securityfocus.com/bid/57757/info ezStats2 is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability using directory-traversal strings to view files and execute local scripts in the conte...

WordPress Plugin Audio Player - playerID Cross-Site Scripting

WordPress Plugin Audio Player - playerID Cross-Site Scripting source: https://www.securityfocus.com/bid/57848/info The Audio Player plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue ...

WordPress Plugin Audio Player - 'playerID' Cross-Site Scripting

source: https://www.securityfocus.com/bid/57848/info The Audio Player plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an...

iCart Pro - 'section' SQL Injection

source: https://www.securityfocus.com/bid/57564/info iCart Pro is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input before using it in an SQL query. A successful exploit may allow an attacker to compromise the application, access or modify data,...

MantisBT CVE-2013-1934 HTML Injection Vulnerability

Description MantisBT is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied data. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based...