CMSLogik 1.2.1 User Enumeration Weakness

!/usr/bin/python CMSLogik 1.2.1 user param User Enumeration Weakness Vendor: ThemeLogik Product web page: http://www.themelogik.com/cmslogik Affected version: 1.2.1 and 1.2.0 Summary: CMSLogik is built on a solid & lightweight framework called CodeIgniter, and design powered by Bootstrap. This...

CVE-2010-5284

Multiple cross-site scripting XSS vulnerabilities in Collabtive 0.6.5 allow remote attackers to inject arbitrary web script or HTML via the 1 User parameter in the edit user profile feature to manageuser.php, 2 y parameter in a newcal action to manageajax.php, and the 3 pic parameter to thumb.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Collabtive 0.6.5 allow remote attackers to inject arbitrary web script or HTML via the 1 User parameter in the edit user profile feature to manageuser.php, 2 y parameter in a newcal action to manageajax.php, and the 3 pic parameter to thumb.php...

CVE-2010-5284

Multiple cross-site scripting XSS vulnerabilities in Collabtive 0.6.5 allow remote attackers to inject arbitrary web script or HTML via the 1 User parameter in the edit user profile feature to manageuser.php, 2 y parameter in a newcal action to manageajax.php, and the 3 pic parameter to thumb.php...

CVE-2010-5284

Multiple cross-site scripting XSS vulnerabilities in Collabtive 0.6.5 allow remote attackers to inject arbitrary web script or HTML via the 1 User parameter in the edit user profile feature to manageuser.php, 2 y parameter in a newcal action to manageajax.php, and the 3 pic parameter to thumb.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in SquidClamav 5.x before 5.8 allow remote attackers to inject arbitrary web script or HTML via the 1 url, 2 virus, 3 source, or 4 user parameter to a clwarn.cgi, b clwarn.cgi.deDE, c clwarn.cgi.enEN, d clwarn.cgi.frFR, e clwarn.cgi.ptBR, or f...

CVE-2012-2156

Multiple cross-site scripting XSS vulnerabilities in Plume CMS 1.2.4 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the uemail parameter aka Authors Email field to manager/users.php, 2 the urealname parameter aka Authors Name field to manager/users.php, or 3 the...

CVE-2011-4826: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in session.php in AutoSec Tools V-CMS 1.0 allows remote attackers to execute arbitrary SQL commands via the user parameter to process.php. NOTE: some of these details are obtained from third party information...

Cross site scripting

Cross-site scripting XSS vulnerability in zp-core/admin.php in Zenphoto 1.3 allows remote attackers to inject arbitrary web script or HTML via the user parameter. NOTE: the from parameter is already covered by CVE-2009-4562...

CVE-2010-4907: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in zp-core/admin.php in Zenphoto 1.3 allows remote attackers to inject arbitrary web script or HTML via the user parameter. NOTE: the from parameter is already covered by CVE-2009-4562...

CVE-2009-4842

Multiple cross-site scripting XSS vulnerabilities in ToutVirtual VirtualIQ Pro 3.5 build 8691 allow remote attackers to inject arbitrary web script or HTML via the 1 addNewDept, 2 deptId, or 3 deptDesc parameter to tvserver/server/user/addDepartment.jsp; or the 4 firstName, 5 lastName, or 6 email...

CVE-2010-1709

Multiple cross-site scripting XSS vulnerabilities in upload.cgi in G5-Scripts Auto-Img-Gallery 1.1 allow remote attackers to inject arbitrary web script or HTML via the 1 user and 2 pass parameters...

CVE-2010-1709: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in upload.cgi in G5-Scripts Auto-Img-Gallery 1.1 allow remote attackers to inject arbitrary web script or HTML via the 1 user and 2 pass parameters...

CVE-2010-1604: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in adminlogin.php in NCT Jobs Portal Script allow remote attackers to execute arbitrary SQL commands via the 1 user parameter aka login field and 2 passwd parameter aka password field. NOTE: some of these details are obtained from third party information...

CVE-2009-4721

CVE-2009-4721 affects Andrews-Web (A-W) BannerAd 1.0, with multiple SQL injection vulnerabilities in Admin/index.asp that allow remote attackers to execute arbitrary SQL commands via the (1) User and (2) Password parameters. The root cause is unsafely constructed SQL queries in that page, enablin...

CVE-2009-4721: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Admin/index.asp in Andrews-Web A-W BannerAd 1.0 allow remote attackers to execute arbitrary SQL commands via the 1 User and 2 Password parameters. NOTE: some of these details are obtained from third party information...

CVE-2010-0952: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in OneCMS 2.5, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the user parameter in an elite action...

CVE-2009-3543: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in phenotype/admin/login.php in Phenotype CMS before 2.9 allows remote attackers to execute arbitrary SQL commands via the user parameter aka the login name...

CVE-2009-3255: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in RASH Quote Management System RQMS 1.2.2 and earlier, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the user parameter in an admin action to the default URI...

CVE-2009-3171

Multiple cross-site scripting XSS vulnerabilities in Anantasoft Gazelle CMS 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 user parameter to user.php or 2 lookup parameter to search.php...