SA-CONTRIB-2015-009 - Linkit - Cross Site Scripting (XSS)

Linkit provides an easy interface for internal and external linking with wysiwyg editors and fields by using an autocomplete field. The module doesn't sufficiently sanitize node titles in the result list if the node search plugin is enabled. This vulnerability is mitigated by the fact that an...

WordPress Better Search Plugin <= 1.3.4 - Reflective XSS

This plugin is prone to a reflective cross site scripting vulnerability. Solution Update the plugin...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in improved-user-search-in-backend.php in the backend in the Improved user search in backend plugin before 1.2.5 for WordPress allows remote attackers to hijack the authentication of administrators for requests that insert XSS sequences via the...

WordPress Better Search Plugin <= 1.2.1 - CSRF

This plugin is prone to a cross site request forgery vulnerability in admin.inc.php. Solution Upgrade the plugin...

CVE-2011-5193

The CVE-2011-5193 entry concerns the WordPress plugin “Whois Search” (plugin path: vendors/samswhois/samswhois.inc.php). The vulnerability is an XSS in the index.php domain parameter when the WHOIS widget is enabled, exploitable in plugin versions around 1.4.2.3 (per CVE-2011-5193). Connected dat...

WordPress Whois Search Plugin <= 1.4.2.2 - XSS

Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "domain" parameter. Solution Update the plugin...

Search for specified dirs

This Plugin is searching for the specified webdirs. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2011-4709

Multiple cross-site scripting XSS vulnerabilities in Hotaru.php in the Search plugin 1.3 for Hotaru CMS allow remote attackers to inject arbitrary web script or HTML via the 1 SITENAME parameter to adminindex.php, or the 2 return and 3 search parameters to index.php. NOTE: some of these details a...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Hotaru.php in the Search plugin 1.3 for Hotaru CMS allow remote attackers to inject arbitrary web script or HTML via the 1 SITENAME parameter to adminindex.php, or the 2 return and 3 search parameters to index.php. NOTE: some of these details a...

CVE-2011-4709

Multiple cross-site scripting XSS vulnerabilities in Hotaru.php in the Search plugin 1.3 for Hotaru CMS allow remote attackers to inject arbitrary web script or HTML via the 1 SITENAME parameter to adminindex.php, or the 2 return and 3 search parameters to index.php. NOTE: some of these details a...

CVE-2011-4709

CVE-2011-4709 is an XSS issue in Hotaru CMS (admin_index.php SITE_NAME and related admin/index parameters). Connected Red Hat/Veracode records tie a stored-XSS variant to Hotaru CMS v1.7.2 via SITE_NAME, indicating a broader XSS lineage. The sources here do not specify exact affected versions or ...

CVE-2010-4518

Cross-site scripting XSS vulnerability in wp-safe-search/wp-safe-search-jx.php in the Safe Search plugin 0.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the v1 parameter...

CVE-2010-4518

Cross-site scripting XSS vulnerability in wp-safe-search/wp-safe-search-jx.php in the Safe Search plugin 0.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the v1 parameter...

CVE-2010-4518

The CVE-2010-4518 entry concerns the WordPress Safe Search Plugin (

Sql injection

SQL injection vulnerability in the plgSearchEventsearch::onSearch method in eventsearch.php in the JEvents Search plugin 1.5 through 1.5.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via unspecified vectors. NOTE: some of these details are obtained from third party...

CVE-2010-0635

The CVE-2010-0635 entry concerns Joomla! with the JEvents plugin (versions 1.5–1.5.3). The vulnerability is an SQL injection in the plgSearchEventsearch::onSearch function within eventsearch.php, allowing remote attackers to execute arbitrary SQL commands via unspecified vectors. Impact is descri...

Ubuntu 5.04 : mozilla-firefox, mozilla vulnerabilities (USN-124-1)

When a popup is blocked the user is given the ability to open that popup through the popup-blocking status bar icon and, in Firefox, through the information bar. Doron Rosenberg noticed that popups which are permitted by the user were executed with elevated privileges, which could be abused to...

USN-124-1: Mozilla and Firefox vulnerabilities

When a popup is blocked the user is given the ability to open that popup through the popup-blocking status bar icon and, in Firefox, through the information bar. Doron Rosenberg noticed that popups which are permitted by the user were executed with elevated privileges, which could be abused to...

CVE-2005-1157

Firefox before 1.0.3, Mozilla Suite before 1.7.7, and Netscape 7.2 allows remote attackers to replace existing search plugins with malicious ones using sidebar.addSearchEngine and the same filename as the target engine, which may not be displayed in the GUI, which could then be used to execute...

CVE-2005-1156

Firefox before 1.0.3, Mozilla Suite before 1.7.7, and Netscape 7.2 allows remote attackers to execute arbitrary script and code via a new search plugin using sidebar.addSearchEngine, aka "Firesearching 1."...