CVE-2023-49034

Cross Site Scripting XSS vulnerability in ProjeQtOr 11.0.2 allows a remote attacker to execute arbitrary code via a crafted script to thecheckvalidHtmlText function in the ack.php and security.php files...

CVE-2021-44565: Improper Neutralization of Input During Web Page Generation

A Cross Site Scripting XSS vulnerability exists in RosarioSIS before 7.6.1 via the xssclean function in classes/Security.php, which allows remote malicious users to inject arbitrary JavaScript or HTML. An example of affected components are all Markdown input fields...

CVE-2016-10510: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Security component of Kohana before 3.3.6 allows remote attackers to inject arbitrary web script or HTML by bypassing the stripimagetags protection mechanism in system/classes/Kohana/Security.php...

Joomla Incapsula 1.4.6_b Cross Site Scripting

Joomla Incapsula Component target="blank" class="IFJlink" Click here to upgrade your account Patch: ------ 22: " target="blank" class="IFJlink"Click here to upgrade your account -------------------------------------------------------------------------- Tested on: Microsoft Windows 7 Ul...

Joomla Incapsula 1.4.6_b Cross Site Scripting Vulnerability

Joomla Incapsula component versions 1.4.6b and below suffer from a reflective cross site scripting vulnerability. Joomla Incapsula Component target="blank" class="IFJlink" Click here to upgrade your account Patch: ------ 22: " target="blank" class="IFJlink"Click here to upgrade your account...

CVE-2010-4335: Improper Input Validation

The validatePost function in libs/controller/components/security.php in CakePHP 1.3.x through 1.3.5 and 1.2.8 allows remote attackers to modify the internal Cake cache and execute arbitrary code via a crafted dataTokenfields value that is processed by the unserialize function, as demonstrated by...

Geeklog SEC_authenticate()函数SQL注入漏洞

BUGTRAQ ID: 34456 Geeklog是一个免费的、开放源码的Web应用程序。它可以使用户创建一个虚拟的社区，可以管理用户，张贴文章等。Geeklog采用PHP实现，以MySQL为后台数据库。 Geeklog的index.php模块中的SECauthenticate函数没有正确的验证用户所提交的PHPAUTHUSER和 REMOTEUSER变量参数，远程攻击者可以通过提交恶意查询请求执行SQL注入攻击。以下是/publichtml/webservices /atom/index.php文件中34-53行的有漏洞代码段： ... requireonce...

Geeklog <= 1.5.2 SEC_authenticate() SQL Injection Exploit

Exploit for unknown platform in category web applications ========================================================= Geeklog = 5.0 google dorks: "By Geeklog" "Created this page in" +seconds +powered "By Geeklog" "Created this page in" +seconds +powered inurl:publichtml vulnerability, see...

CVE-2007-6622: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in security.php in ZeusCMS 0.3 and earlier allows remote attackers to execute arbitrary SQL commands via the Referer HTTP header...

CVE-2005-1610: Undefined Security Weakness

Cross-site scripting XSS vulnerability in security.php for Tru-Zone NukeET 3.0 and 3.1 allows remote attackers to inject arbitrary web script or HTML via a base64 encoded Codigo parameter...