CVE-2019-9858

Remote code execution was discovered in Horde Groupware Webmail 5.2.22 and 5.2.17. Horde/Form/Type.php contains a vulnerable class that handles image upload in forms. When the HordeFormTypeimage method onSubmit is called on uploads, it invokes the functions getImage and getUpload, which uses...

CVE-2018-12909

Webgrind 1.5 relies on user input to display a file, which lets anyone view files from the local filesystem that the webserver user has access to via an index.php?op=fileviewer&file= URI. NOTE: the vendor indicates that the product is not intended for a "publicly accessible environment...

CVE-2015-9239

ansi2html is vulnerable to regular expression denial of service ReDoS when certain types of user input is passed in...

PT-2018-23: Remote Code Execution in PRTG Network Monitor

The specialists of the Positive Research center have detected a Remote Code Execution vulnerability in PRTG Network Monitor. Vulnerability due to improper handling of user input in the POST parameter 'proxyport' allows remote authenticated attackers with read-write privileges to execute an...

CVE-2017-15273

Mahara 15.04 before 15.04.15, 16.04 before 16.04.9, 16.10 before 16.10.6, and 17.04 before 17.04.4 are vulnerable to a user submitting a potential dangerous payload, e.g., XSS code, to be saved as titles in internal artefacts...

Cross-site Scripting (XSS)

candy is vulnerable to cross-site scripting XSS attacks. Text sent by users is not sanitized in any way, allowing attackers to execute JavaScript code...

Acoustica Pianissimo 1.0 Build 12 Buffer Overflow

Acoustica Pianissimo 1.0 Build 12 Registration ID Buffer Overflow PoC Vendor: Acoustica, Inc. Product web page: http://www.acoustica.com Affected version: 1.0 Build 12 Summary: Pianissimo virtual piano uses a combination of sample playback and advanced physical modeling to create a stunning...

Active Auction House ItemInfo.ASP SQL Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/13034/info Active Auction House is reportedly affected by a SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in a SQL query. Successfu...

eventum issue tracking system 2.3.1 - Persistent Cross-Site Scripting

eventum issue tracking system 2.3.1 - Persistent Cross-Site Scripting Exploit Title: Eventum 2.3.1 stored XSS Date: 19-2-2011 Author: Saif El-Sherei Software Link: https://code.launchpad.net/eventum Version: Eventum 2.3.1 Tested on: FF 3.0.15, IE 8 Vendor notification: vendor notified, awaiting...

GetSimple CMS 2.01 Cross Site Scripting

Vulnerability ID: HTB22375 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityingetsimplecms.html Product: GetSimple CMS Vendor: Cagintranet Networks Vulnerable Version: 2.01 and Probably Prior Versions Vendor Notification: 10 May 2010 Vulnerability Type: XSS Cross Site Scripting Status:...

My Book World Edition NAS multiple vulnerability

Exploit for unknown platform in category web applications ================================================ My Book World Edition NAS multiple vulnerability ================================================ Exploit Title: My Book World Edition NAS multiple vulnerability Date: 20091230 Author:...

Mthree Development MP3 to WAV Decoder - .mp3 Remote Buffer Overflow

Mthree Development MP3 to WAV Decoder - .mp3 Remote Buffer Overflow // source: https://www.securityfocus.com/bid/41912/info MP3 to WAV Decoder is prone to a remote stack-based buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input. Successfully...

Coppermine Photo Gallery 1.4.21 XSS

Coppermine Photo Gallery 1.4.21 Cross-Site Scripting Author: Gerendi Sandor Attila Date: April 29, 2009 Package: Coppermine Photo Gallery cpg1.4.21 Product homepage: http://coppermine-gallery.net/ Versions Affected: v.1.4.21 older versions are also affected Advisory:...

Mandriva Update for samba MDKSA-2007:104 (samba)

Check for the Version of samba OpenVAS Vulnerability Test Mandriva Update for samba MDKSA-2007:104 samba Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

Te Ecard - 'id' Multiple SQL Injections

source: https://www.securityfocus.com/bid/29478/info Te Ecard is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input before using it in an SQL query. Exploiting these issues could allow an attacker to compromise the application, access or...

LS simple guestbook - arbitrary code execution

Special Greetings To - Timq,Warpboy,The-Maggot File: index.php Affects: LS simple guestbook v1 Date: 15th April 2007 Issue Description: =========================================================================== LS simple guestbook fails to sanitize user input that it writes to the posts.txt file...

Magic Photo Storage Website - adminindex.php?_config[site_path] Remote File Inclusion

Magic Photo Storage Website - adminindex.php?configsitepath Remote File Inclusion source: https://www.securityfocus.com/bid/21965/info Magic Photo Storage Website is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting thes...

Telekorn Signkorn Guestbook 1.x - helpenadminhelp1.php?dir_path Remote File Inclusion

Telekorn Signkorn Guestbook 1.x - helpenadminhelp1.php?dirpath Remote File Inclusion source: https://www.securityfocus.com/bid/19977/info Telekorn Signkorn Guestbook is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. This may all...

Oi! Email Marketing System 3.0 - 'index.php' SQL Injection

source: https://www.securityfocus.com/bid/16794/info Oi! Email Marketing System is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation could allow an attacker t...

BMForum 3.0 - post.php Cross-Site Scripting

BMForum 3.0 - post.php Cross-Site Scripting source: https://www.securityfocus.com/bid/14396/info BMForum is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage any of these...