92 matches found
ZenTaoPMS (Zendo) Arbitrary Code Execution Vulnerability
ZenTaoPMS ZenTao is home-made open source project management software. ZenTaoPMS Zendo arbitrary code execution vulnerability exists. Due to the ZenTaoPMS software source code in the upgrade.php file module lack of permissions verification , allowing attackers to exploit this vulnerability can be...
CVE-2014-5345
Cross-site scripting XSS vulnerability in upgrade.php in the Disqus Comment System plugin before 2.76 for WordPress allows remote attackers to inject arbitrary web script or HTML via the step parameter...
Cross site scripting
Cross-site scripting XSS vulnerability in upgrade.php in the Disqus Comment System plugin before 2.76 for WordPress allows remote attackers to inject arbitrary web script or HTML via the step parameter...
CVE-2014-5345
The CVE-2014-5345 entry concerns a Cross-Site Scripting (XSS) vulnerability in the Disqus Comment System WordPress plugin’s upgrade.php, exploitable via the step parameter in versions prior to 2.76. Affected software: Disqus Comment System plugin for WordPress (pre-2.76). Root cause: improper han...
PT-2014-6424
Name of the Vulnerable Software and Affected Versions Disqus Comment System plugin versions prior to 2.76 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the step parameter in the...
CVE-2014-5345: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in upgrade.php in the Disqus Comment System plugin before 2.76 for WordPress allows remote attackers to inject arbitrary web script or HTML via the step parameter...
Link Bid Script 1.5 - Multiple Remote SQL Injection Vulnerabilities
No description provided by source. + Link Bid Script 1.5 Multiple Remote SQL Injection + Discovered By SirGod + wWw.MorTal-TeaM.OrG + Greetz : E.M.I.N.E.M,Ras,Puscasmarin,ToxicBlood,HrN,kemrayz,007m,Raven,Nytr0gen,str0ke + Remote SQL Injection - Note : For PoC 2 you need administrative rights. Po...
Indexu 5.0/5.3 upgrade.php gateway Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/22084/info Indexu is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code execute in the...
vBulletin install upgrade.php Privilege Escalation (CVE-2013-6129)
A privilege escalation vulnerability has been reported in vBulletin. A remote attacker may exploit this issue by sending a specially crafted POST message to the "install/upgrade.php" component of the server via the customerid, htmldatapassword, htmldataconfirmpassword, and htmldataemail parameter...
vBulletin remote admin injection exploit
!/usr/bin/perl Title: vBulletin remote admin injection exploit Author: Simo Ben youssef Contact: SimoatMorxploitcom Coded: 17 September 2013 Published: 24 October 2013 MorXploit Research http://www.MorXploit.com Vendor: vBulletin www.vbulletin.com Version: 4.1.x / 5.x.x Vulnerability: Remote admi...
vBulletin 4.1.x / 5.x.x Administrative User Injection
!/usr/bin/perl Title: vBulletin remote admin injection exploit Author: Simo Ben youssef Contact: SimoatMorxploitcom Coded: 17 September 2013 Published: 24 October 2013 MorXploit Research http://www.MorXploit.com Vendor: vBulletin www.vbulletin.com Version: 4.1.x / 5.x.x Vulnerability: Remote admi...
Design/Logic Flaw
The install/upgrade.php scripts in vBulletin 4.1 and 5 allow remote attackers to create administrative accounts via the customerid, htmldatapassword, htmldataconfirmpassword, and htmldataemail parameters, as exploited in the wild in October 2013...
CVE-2013-6129
The install/upgrade.php scripts in vBulletin 4.1 and 5 allow remote attackers to create administrative accounts via the customerid, htmldatapassword, htmldataconfirmpassword, and htmldataemail parameters, as exploited in the wild in October 2013...
CVE-2013-6129
The vBulletin software (versions 4.1 and 5 ) contains a privilege escalation vulnerability in the install/upgrade.php script. Remote attackers can exploit this by sending a specially crafted POST message using the customerid , htmldata[password] , htmldata[confirmpassword] , and htmldata[email] p...
CVE-2013-6129: Undefined Security Weakness
The install/upgrade.php scripts in vBulletin 4.1 and 5 allow remote attackers to create administrative accounts via the customerid, htmldatapassword, htmldataconfirmpassword, and htmldataemail parameters, as exploited in the wild in October 2013...
CVE-2012-2208
Directory traversal vulnerability in upgrade.php in Piwigo before 2.3.4 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the language parameter...
CVE-2012-2208
Directory traversal vulnerability in upgrade.php in Piwigo before 2.3.4 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the language parameter...
CVE-2012-2208
Directory traversal vulnerability in upgrade.php in Piwigo before 2.3.4 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the language parameter...
CVE-2012-2208
CVE-2012-2208 : Affected software is Piwigo up to version 2.3.3 (pre-2.3.4). Root cause is a directory traversal via the language parameter in upgrade.php, allowing remote attackers to include and execute arbitrary local PHP files. Impact: potential code execution through include() of crafted fil...
