Unspecified vulnerability in html-janitor

html-janitor is a module for controlling, cleaning up HTML. A security vulnerability exists in html-janitor. An attacker can exploit this vulnerability to bypass the filtering process with the help of the 'sanitized' variable...

CVE-2017-0928

html-janitor node module suffers from an External Control of Critical State Data vulnerability via user-control of the 'sanitized' variable causing sanitization to be bypassed...

My Calendar 2.5.16 Cross Site Scripting

An authenticated user, who can add new events, can inject arbitrary javascript code via eventtimelabel input. The arbitrary code runs both on the event page and in the admin panel. In my-calendar-event-manager.php, line 1873, the variable $eventTime is not sanitized. Vulnerability is fixed in My...

CVE-2017-1002027

Vulnerability in wordpress plugin rk-responsive-contact-form v1.0, The variable $delid isn't sanitized before being passed into an SQL query in file ./rk-responsive-contact-form/include/rkuserlist.php...

Posnic 1.03 Unauthorized Password Recovery Vulnerability

Exploit for php platform in category web applications ------------------------------------------------------------------------- + Posnic 1.03 forgetpass.php Unauthorized Password Recovery ------------------------------------------------------------------------ Discovered by Juri Gianni -...

Joomla LMO Component <= 1.0b2 Remote Include Vulnerability

No description provided by source. Application : LMO - Joomla! Component URL : http://forge.joomla.org/sf/projects/lmo Variable $mosConfigabsolutepath not sanitized: xpl works with registerglobals=on in components/comlmo/lmo.php on line 11-12...

Osprey <= 1.0 GetRecord.php Remote File Include Vulnerability

Exploit for unknown platform in category web applications ============================================================= Osprey = 1.0 GetRecord.php Remote File Include Vulnerability =============================================================...

cms-bandits2.5.txt

----------------------------------------------------- Advisory id: FSA:006 Author: Federico Fazzi Date: 08/06/2006, 11:09 Sinthesis: cms-bandits 2.5, Remote command execution Type: high Product: http://sourceforge.net/projects/cms-bandits Patch: unavailable...

[Full-disclosure] EZDatabase Directory Transversal, XSS and Path Disclosure Vulnerability

Synopsis: EZDatabase directory transversal, XSS and path disclosure vulnerability Product: EZDatabase http://www.ezdatabase.org Version: Confirmed on EZDatabase 2.1.2 Author: Josh Zlatin-Amishav Date: January 15, 2006 Background: Written in PHP and MySQL, ezDatabase is the foundation for your...