toppreise.ch XSS vulnerability

Open Bug Bounty ID: OBB-673452 Description| Value ---|--- Affected Website:| toppreise.ch Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2012-5243

functions/suggest.php in Banana Dance B.2.6 and earlier allows remote attackers to read arbitrary database information via a crafted request...

PT-2014-2303

Name of the Vulnerable Software and Affected Versions Banana Dance versions B.2.6 and earlier Description The issue allows remote attackers to read arbitrary database information via a crafted request to the functions/suggest.php endpoint. Recommendations For Banana Dance versions B.2.6 and...

CVE-2012-5243: Undefined Security Weakness

functions/suggest.php in Banana Dance B.2.6 and earlier allows remote attackers to read arbitrary database information via a crafted request...

CVE-2012-5242: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in functions/suggest.php in Banana Dance B.2.6 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the name parameter in a gettemplate action...

PT-2014-2302

Name of the Vulnerable Software and Affected Versions Banana Dance versions B.2.6 and earlier Description The issue allows remote attackers to include and execute arbitrary local files via a .. dot dot in the name parameter in a "get template" action. This is a directory traversal vulnerability i...

Sql injection

Multiple SQL injection vulnerabilities in Banana Dance B.2.6 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 return, 2 display, 3 table, or 4 search parameter to functions/suggest.php; 5 the id parameter to functions/widgets.php, 6 the category parameter to...

PT-2014-2304

Name of the Vulnerable Software and Affected Versions Banana Dance versions B.2.6 and earlier Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via several parameters to different functions, including the return, display, table, or search...

CVE-2012-5244: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Banana Dance B.2.6 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 return, 2 display, 3 table, or 4 search parameter to functions/suggest.php; 5 the id parameter to functions/widgets.php, 6 the category parameter to...