CVE-2012-5164

Multiple cross-site scripting XSS vulnerabilities in Fork CMS before 3.2.7 allow remote attackers to inject arbitrary web script or HTML via the term parameter to 1 autocomplete.php, 2 search/ajax/autosuggest.php, 3 livesuggest.php, or 4 save.php in frontend/modules/search/ajax...

CVE-2012-1901: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in FlexCMS 3.2.1 and earlier allow remote attackers to 1 hijack the authentication of users for requests that change account settings via a request to index.php/profile-edit-save or 2 hijack the authentication of administrators for requests...

PG Portal Pro - Cross-Site Request Forgery

PG Portal Pro - Cross-Site Request Forgery Exploit Title: PG Portal pro CSRF Vulnerability Author: Noxious Team: WE SECRET Gr33tz: Fox link:http://www.hotscripts.com/listing/pg-portal-pro/ CSRF Change Password New Password: Confirm New Password:...

CVE-2012-2075

Cross-site scripting XSS vulnerability in the Contact Save module 6.x-1.x before 6.x-1.5 for Drupal allows remote authenticated users with the access site-wide contact form permission to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-2075

CVE-2012-2075 is a Cross-Site Scripting vulnerability in the Drupal Contributed module Contact Save (6.x-1.x) prior to version 6.x-1.5 . The issue arises because the module does not sufficiently filter user-submitted text, allowing a remote authenticated user with the access site-wide contact for...

CVE-2012-2075

Cross-site scripting XSS vulnerability in the Contact Save module 6.x-1.x before 6.x-1.5 for Drupal allows remote authenticated users with the access site-wide contact form permission to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-2075: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Contact Save module 6.x-1.x before 6.x-1.5 for Drupal allows remote authenticated users with the access site-wide contact form permission to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-2302

Site Documentation Sitedoc module for Drupal 6.x-1.x before 6.x-1.4 does not properly check the save location when archiving, which allows remote attackers to obtain sensitive information via unspecified vectors...

CVE-2012-2356

The question-bank functionality in Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to bypass intended capability requirements and save questions via a savequestion action...

UBUNTU-CVE-2012-2356

The question-bank functionality in Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to bypass intended capability requirements and save questions via a savequestion action...

CVE-2012-2356

Summary of CVE-2012-2356 Affected: Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3. Issue: remote authenticated users can bypass intended capability requirements in the question-bank feature and save questions via a save_question action. Root cause: not explicitly detailed in the provided docume...

[SECURITY] Fedora 17 Update: rubygem-activerecord-3.0.11-3.fc17

Implements the ActiveRecord pattern Fowler, PoEAA for ORM. It ties databa se tables and classes together for business objects, like Customer or Subscription, that can find, save, and destroy themselves without resorting to manual SQL...

Oracle Forms Recognition CroScPlt.dll ActiveX Control Remote Code Execution Vulnerabilty

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle WebCenter Forms Recognition. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists with...

Link Up Gold CSRF Vulnerability

Exploit for php platform in category web applications Exploit Title: Link Up Gold CSRF Author: Jonturk75 Category:: webapps Demo : http://demo.scripts-gate.com/LinkUpGold/administration Greetz: Inj3ct0r Exploit DataBase 1337day.com 0day.today 2018-04-14...

SA-CONTRIB-2012-048 - Contact Save - Cross Site Scripting

CVE: CVE-2012-2075 This module stores in the database all messages submitted through the core contact forms, and provides a way to respond to these messages through the website. The module doesn't sufficiently filter user supplied text, leading to a cross-site scripting XSS vulnerability. This...

PM Report CSRF Vulnerability

Exploit for php platform in category web applications Exploit Title: PM Report CSRF Author: Jonturk75 Vendor or Software Link: http://www.scripts.com/viewscript/pm-report/20972/ Category:: webapps Demo : http://www.busmgtsys.com/dolphinninedemo/ Greetz: Inj3ct0r Exploit DataBase 1337day.com Save...

FlexCMS 3.2.1 Cross Site Request Forgery

+---------------------------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : FlexCMS 3.2.1 Multiple CSRF Date : 16-03-2012 Author : Ivano Binetti http://www.ivanobinetti.com Software link :...

Path traversal

translate.php in Support Incident Tracker aka SiT! 3.45 through 3.65 allows remote attackers to obtain sensitive information via a direct request using the save action, which reveals the installation path...

CVE-2011-5075: Undefined Security Weakness

translate.php in Support Incident Tracker aka SiT! 3.45 through 3.65 allows remote attackers to obtain sensitive information via a direct request using the save action, which reveals the installation path...

Path traversal

Absolute path traversal vulnerability in the ALMListView.ALMListCtrl ActiveX control in almaxcx.dll in the graphical user interface in Siemens Automation License Manager ALM 2.0 through 5.1+SP1+Upd2 allows remote attackers to overwrite arbitrary files via the Save method...