294 matches found
WordPress Symposium Plugin <= 11.12.07 - XSS
Because of this vulnerability in uploadify/getprofileavatar.php, the attackers can inject arbitrary web script or HTML via the "uid" parameter. Solution Update the plugin...
CVE-2009-4939
Multiple cross-site scripting XSS vulnerabilities in index.php in AdPeeps 8.5d1 allow remote attackers to inject arbitrary web script or HTML via the 1 uid parameter, 2 uid parameter in a loginlookup action, 3 uid parameter in an adminlogin action, 4 campaignid parameter in a createcampaign actio...
CVE-2009-4939
Multiple cross-site scripting XSS vulnerabilities in index.php in AdPeeps 8.5d1 allow remote attackers to inject arbitrary web script or HTML via the 1 uid parameter, 2 uid parameter in a loginlookup action, 3 uid parameter in an adminlogin action, 4 campaignid parameter in a createcampaign actio...
SnowFlake CMS 1.0 Beta5.2 SQL Injection
Exploit Title: Powered by SnowFlake Content Management System SQL Injection Date: 19th july 2010 Author: Dinesh Arora Critical:high Affected / Tested Version : 1.0 beta5.2 Sample Affected Parameter: uid contact: [email protected] Greetz to :b0nd, Fbih2s,Beenu,Charles ,j4ckh4x0r, punter,eberl...
Discuz! 6.0论坛uid参数远程跨站脚本漏洞
BUGTRAQ ID: 38484 Discuz!是一款华人地区非常流行的Web论坛程序。 Discuz!论坛没有正确的过滤提交给eccredit.php页面的uid参数，远程攻击者可以通过向论坛提交恶意参数请求执行跨站脚本攻击，导致在用户浏览器会话中注入并执行任意HTML和脚本代码。 Comsenz Discuz! 6.0 厂商补丁： Comsenz ------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.comsenz.com/index.php...
CVE-2009-4384
Multiple cross-site scripting XSS vulnerabilities in Scriptsez.net Ez Poll Hoster EPH allow remote attackers to inject arbitrary web script or HTML via the 1 pid parameter in a code action to index.php and the 2 uid parameter in a view action to profile.php...
Sql injection
SQL injection vulnerability in user.php in Super Serious Stats aka superseriousstats before 1.1.2p1 allows remote attackers to execute arbitrary SQL commands via the uid parameter, related to an "incorrect regexp." NOTE: some of these details are obtained from third party information...
CVE-2009-3961
The CVE-2009-3961 entry describes an SQL injection in Super Serious Stats (aka superseriousstats) through user.php, exploitable via the uid parameter and related to an "incorrect regexp." The vulnerability affects versions before 1.1.2p1 and could allow remote attackers to execute arbitrary SQL c...
CVE-2009-3961: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in user.php in Super Serious Stats aka superseriousstats before 1.1.2p1 allows remote attackers to execute arbitrary SQL commands via the uid parameter, related to an "incorrect regexp." NOTE: some of these details are obtained from third party information...
Sql injection
SQL injection vulnerability in Profile.php in MyMsg 1.0.3 allows remote authenticated users to execute arbitrary SQL commands via the uid parameter in a show action...
CVE-2009-3528: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in Profile.php in MyMsg 1.0.3 allows remote authenticated users to execute arbitrary SQL commands via the uid parameter in a show action...
Sql injection
Multiple SQL injection vulnerabilities in Videos Broadcast Yourself 2 allow remote attackers to execute arbitrary SQL commands via the 1 UploadID parameter to videoint.php, and possibly the 2 catid parameter to catvideo.php and 3 uid parameter to cviewchannels.php...
CVE-2009-2924
Multiple SQL injection vulnerabilities in Videos Broadcast Yourself 2 allow remote attackers to execute arbitrary SQL commands via the 1 UploadID parameter to videoint.php, and possibly the 2 catid parameter to catvideo.php and 3 uid parameter to cviewchannels.php...
CVE-2008-6524: Undefined Security Weakness
resetpass.php in openInvoice 0.90 beta and earlier allows remote authenticated users to change the passwords of arbitrary users via a modified uid parameter. NOTE: this can be leveraged with a separate vulnerability in auth.php to modify passwords without authentication...
CVE-2008-6438: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in macgurublogmenu/macgurublog.php in the MacGuru BLOG Engine plugin 2.2 for e107 allows remote attackers to execute arbitrary SQL commands via the uid parameter, a different vector than CVE-2008-2455. NOTE: it was later reported that 2.1.4 is also affected...
CVE-2008-4352: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in inc/pages/viewprofile.php in phpSmartCom 0.2 allows remote attackers to execute arbitrary SQL commands via the uid parameter in a viewprofile action to index.php...
Sql injection
SQL injection vulnerability in members.asp in Mini-NUKE Freehost 2.3 allows remote attackers to execute arbitrary SQL commands via the uid parameter in a memberdetails action...
CVE-2008-3888
SQL injection vulnerability in members.asp in Mini-NUKE Freehost 2.3 allows remote attackers to execute arbitrary SQL commands via the uid parameter in a memberdetails action...
CVE-2008-3888: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in members.asp in Mini-NUKE Freehost 2.3 allows remote attackers to execute arbitrary SQL commands via the uid parameter in a memberdetails action...