SPIP connect Parameter PHP Injection

No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3...

SPIP 1.8.3 Spip_login.PHP Remote File Include Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/17423/info SPIP is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit this issue to include an arbitrary remot...

SPIP 1.8/1.9 Index.PHP3 Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/16461/info SPIP is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script co...

SPIP 1.8.2 Spip_RSS.PHP Remote Command Execution Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/16556/info SPIP is prone to a remote command-execution vulnerability. This is due to a lack of proper sanitization of user-supplied input. An attacker can exploit this issue to execute arbitrary remote PHP commands on an...

SPIP <= 1.8.2g Remote Commands Execution Exploit

No description provided by source. ?php ---spip182gshellinjxpl.php 17.33 08/02/2006 SPIP = 1.8.2g remote commands execution coded by rgod site: http://retrogod.altervista.org - this works regardless of magicquotesgpc settings usage: launch from Apache, fill in requested fields, then go! Sun-Tzu:...

SPIP CMS 2.0.23 2.1.223.0.9 - Privilege Escalation

SPIP CMS 2.0.23 2.1.223.0.9 - Privilege Escalation !/usr/bin/env python Exploit Title: SPIP - CMS " exit baseurl = sys.argv1 login =...

SPIP CMS < 2.0.23/ 2.1.22/3.0.9 - Privilege Escalation

!/usr/bin/env python Exploit Title: SPIP - CMS " exit baseurl = sys.argv1 login = sys.argv2 mail = sys.argv3 cookiejar = cookieli...

CVE-2013-7303

Multiple cross-site scripting XSS vulnerabilities in 1 squelettes-dist/formulaires/inscription.php and 2 prive/forms/editerauteur.php in SPIP before 2.1.25 and 3.0.x before 3.0.13 allow remote attackers to inject arbitrary web script or HTML via the author name field...

CVE-2013-7303

Multiple cross-site scripting XSS vulnerabilities in 1 squelettes-dist/formulaires/inscription.php and 2 prive/forms/editerauteur.php in SPIP before 2.1.25 and 3.0.x before 3.0.13 allow remote attackers to inject arbitrary web script or HTML via the author name field...

DEBIAN-CVE-2013-7303

Multiple cross-site scripting XSS vulnerabilities in 1 squelettes-dist/formulaires/inscription.php and 2 prive/forms/editerauteur.php in SPIP before 2.1.25 and 3.0.x before 3.0.13 allow remote attackers to inject arbitrary web script or HTML via the author name field...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in 1 squelettes-dist/formulaires/inscription.php and 2 prive/forms/editerauteur.php in SPIP before 2.1.25 and 3.0.x before 3.0.13 allow remote attackers to inject arbitrary web script or HTML via the author name field...

CVE-2013-7303

Multiple cross-site scripting XSS vulnerabilities in 1 squelettes-dist/formulaires/inscription.php and 2 prive/forms/editerauteur.php in SPIP before 2.1.25 and 3.0.x before 3.0.13 allow remote attackers to inject arbitrary web script or HTML via the author name field...

CVE-2013-7303

CVE-2013-7303 : The affected software is SPIP. The vulnerability is a cross-site scripting (XSS) flaw in two scripts: squelettes-dist/formulaires/inscription.php and prive/forms/editer_auteur.php. The issue occurs in SPIP versions prior to 2.1.25 and in 3.0.x prior to 3.0.13, allowing remote atta...

CVE-2013-7303

Multiple cross-site scripting XSS vulnerabilities in 1 squelettes-dist/formulaires/inscription.php and 2 prive/forms/editerauteur.php in SPIP before 2.1.25 and 3.0.x before 3.0.13 allow remote attackers to inject arbitrary web script or HTML via the author name field...

CVE-2013-7303

Multiple cross-site scripting XSS vulnerabilities in 1 squelettes-dist/formulaires/inscription.php and 2 prive/forms/editerauteur.php in SPIP before 2.1.25 and 3.0.x before 3.0.13 allow remote attackers to inject arbitrary web script or HTML via the author name field...

SPIP ecran_securite connect Parameter RCE

SPIP core/securite/ecransecurite.php connect Parameter Remote Code Execution Vulnerability Type: Remote Command Execution For the exploit source code contact DSquare Security sales team...

[SECURITY] [DSA 2794-1] spip security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2794-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso November 10, 2013 http://www.debian.org/security/faq -...

Debian DSA-2794-1 : spip - several vulnerabilities

Several vulnerabilities have been found in SPIP, a website engine for publishing, resulting in cross-site request forgery on logout, cross-site scripting on author page, and PHP injection. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...

DEBIAN-CVE-2013-4557

The Security Screen core/securite/ecransecurite.php before 1.1.8 for SPIP, as used in SPIP 3.0.x before 3.0.12, allows remote attackers to execute arbitrary PHP via the connect parameter...

DEBIAN-CVE-2013-4556

Cross-site scripting XSS vulnerability in the author page prive/formulaires/editerauteur.php in SPIP before 2.1.24 and 3.0.x before 3.0.12 allows remote attackers to inject arbitrary web script or HTML via the urlsite parameter...