Sql injection

SQL injection vulnerability in search.php in Banana Dance, possibly B.1.5 and earlier, allows remote attackers to execute arbitrary SQL commands via the category parameter...

CVE-2011-5176

Banana Dance’s search.php contains multiple XSS vulnerabilities exploitable via the q and category parameters. Affected: versions prior to B.1.5. Root cause: insufficient input sanitization in search.php. Impact: remote injection of arbitrary script/HTML. Remediation: upgrade to B.1.5 or newer; a...

CVE-2011-5176: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in search.php in Banana Dance, possibly B.1.5 and earlier, allow remote attackers to inject arbitrary web script or HTML via the 1 q or 2 category parameter...

PT-2012-2153 · Unknown · Banana Dance

Name of the Vulnerable Software and Affected Versions: Banana Dance versions prior to B.1.5 Description: The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the q or category parameters in th...

CVE-2011-5175: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in search.php in Banana Dance, possibly B.1.5 and earlier, allows remote attackers to execute arbitrary SQL commands via the category parameter...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Etano 1.22 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 user, 2 email, 3 email2, 4 f17zip, or 5 agree parameter to join.php; 6 PATHINFO, 7 st, 8 f17city, 9 f17country, 10 f17state, 11 f17zip, 12 f19, 13...

PT-2012-3085

Name of the Vulnerable Software and Affected Versions Etano versions 1.22 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML via various parameters to multiple scripts, including join.php, search.php, photo search.php, and photo view.php. The vulnerab...

CVE-2012-1110: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Etano 1.22 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 user, 2 email, 3 email2, 4 f17zip, or 5 agree parameter to join.php; 6 PATHINFO, 7 st, 8 f17city, 9 f17country, 10 f17state, 11 f17zip, 12 f19, 13...

ArticleSetup 1.1 SQL Injection

HTTPCS Advisory : HTTPCS86 Product : ArticleSetup Version : 1.1 Date : 2012-09-03 Criticality level : Highly Critical Description : A vulnerability has been discovered in ArticleSetup, which can be exploited by malicious people to conduct SQL injection attacks. Input passed via the 'cat' paramete...

ShareLive CMS Cross Site Scripting

Exploit Title: ShareLive cms Cross Site Scripting Vulnerability Google Dork: intext:"Code and Portal design © ShareLive" Date: 08/24/2012 Author: Crim3R Tested on: all ======================================== s parametr in search.php is Vulnerable to xss D3M0 :...

Sql injection

Multiple SQL injection vulnerabilities in MyBB aka MyBulletinBoard before 1.6.1 allow remote attackers to execute arbitrary SQL commands via the keywords parameter in a 1 dosearch action to search.php or 2 dostuff action to private.php. NOTE: the vendor disputes this issue, saying "Although this...

CVE-2010-5096

Multiple SQL injection vulnerabilities in MyBB aka MyBulletinBoard before 1.6.1 allow remote attackers to execute arbitrary SQL commands via the keywords parameter in a 1 dosearch action to search.php or 2 dostuff action to private.php. NOTE: the vendor disputes this issue, saying "Although this...

CVE-2010-5096

Multiple SQL injection vulnerabilities in MyBB (MyBulletinBoard) before 1.6.1 allow remote attackers to execute arbitrary SQL commands via the keywords parameter in do_search (search.php) or do_stuff (private.php). Vendor disputes claim of true SQL injection, noting it may only produce general SQ...

CVE-2010-5096: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in MyBB aka MyBulletinBoard before 1.6.1 allow remote attackers to execute arbitrary SQL commands via the keywords parameter in a 1 dosearch action to search.php or 2 dostuff action to private.php. NOTE: the vendor disputes this issue, saying "Although this...

PT-2012-4587

Name of the Vulnerable Software and Affected Versions web@all versions prior to the version downloaded on May 30, 2012 Description The issue is related to a cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary web script or HTML via the texttitle parameter in the...

CVE-2012-3232: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in search.php in web@all 2.0, as downloaded before May 30, 2012, allows remote attackers to inject arbitrary web script or HTML via the texttitle parameter...

Membris v 2.0.1 Sql \ XSS & File Disclosure Vulnerabilities

Exploit for php platform in category web applications Exploit:Membris v 2.0.1 Sql \ XSS & File Disclosure Vulnerabilities Google Dork: Powered by Membris v 2.0.1 Date: Dr.abolalh Author:01/06/2012 E-Mail: email protected Software Link: http://scripts.toocharger.com/fiches/scripts/membris/5258.htm...

Lizard-Cart 1.04 search.php sql注入漏洞

No description provided by source...

DreamArticle CMS 2.0 Cross Site Scripting

Exploit Title : DreamArticle CMS Cross Site Scripting Vulnerability Author : Secure-Land Security Team Discovered By : farbodmahini Home : Secure-Land.net Version : All Version Contact : [email protected] , [email protected] Security Risk : High DorK : "Powered by DreamArticle V2.0"...

Charles River Web CMS Cross Site Scripting

Exploit Title : Charles-River-Web Cms Cross Site Scripting Vulnerabilitiy Author : IrIsT.Ir Discovered By : Am!r Home : http://IrIsT.Ir & Http://Security7.ir Software Link : http://www.charlesriverweb.com/ Security Risk : High Version : All Version Tested on : GNU/Linux Ubuntu - Windows Server -...