EUVD-2011-4725

Malware in sbrugna...

CVE-2019-9052: Cross-Site Request Forgery (CSRF)

An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete pictures via a /admin.php?action=deleteimage&var1= URI...

PT-2019-19333

Name of the Vulnerable Software and Affected Versions Pluck version 4.7.9-dev1 Description A CSRF issue allows deletion of a theme via the "/admin.php?action=theme delete&var1=" API endpoint. Recommendations For Pluck version 4.7.9-dev1, as a temporary workaround, consider restricting access to t...

PT-2019-19337

Name of the Vulnerable Software and Affected Versions Pluck version 4.7.9-dev1 Description An issue was discovered that allows for a CSRF vulnerability, enabling the deletion of pictures via the "/admin.php?action=deleteimage&var1=" URI. Recommendations For Pluck version 4.7.9-dev1, consider...

PT-2019-19334

Name of the Vulnerable Software and Affected Versions Pluck version 4.7.9-dev1 Description A CSRF issue allows deletion of modules via the "/admin.php?action=module delete&var1=" API endpoint, where var1 is a vulnerable parameter. This can be exploited to delete modules. Recommendations For Pluck...

CVE-2011-4806: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in main.php in phpAlbum 0.4.1.16 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 var1 and 2 keyword parameters...

CVE-2011-4807: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in main.php in phpAlbum 0.4.1.16 and earlier allows remote attackers to read arbitrary files via a .. dot dot in the var1 parameter...

PT-2011-5113

Name of the Vulnerable Software and Affected Versions phpAlbum versions 0.4.1.16 and earlier Description The issue allows remote attackers to read arbitrary files due to a directory traversal vulnerability in the main.php file. This is achieved by using a .. dot dot in the var1 parameter...

PT-2011-5112

Name of the Vulnerable Software and Affected Versions phpAlbum versions 0.4.1.16 and earlier Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the var1 and keyword parameters in...

CVE-2010-4982

SQL injection vulnerability in addressbook/contacts.php in My Kazaam Address & Contact Organizer allows remote attackers to execute arbitrary SQL commands via the var1 parameter...

Sql injection

SQL injection vulnerability in addressbook/contacts.php in My Kazaam Address & Contact Organizer allows remote attackers to execute arbitrary SQL commands via the var1 parameter...

CVE-2010-4982

SQL injection vulnerability in addressbook/contacts.php in My Kazaam Address & Contact Organizer allows remote attackers to execute arbitrary SQL commands via the var1 parameter...

CVE-2010-4982: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in addressbook/contacts.php in My Kazaam Address & Contact Organizer allows remote attackers to execute arbitrary SQL commands via the var1 parameter...

PT-2011-1917

Name of the Vulnerable Software and Affected Versions My Kazaam Address & Contact Organizer affected versions not specified Description The issue allows remote attackers to execute arbitrary SQL commands via the var1 parameter in the address book/contacts.php file. This enables attackers to...

CVE-2005-3948: Undefined Security Weakness

Directory traversal vulnerability in main.php in PHPAlbum 0.2.3 and earlier allows remote attackers to read arbitrary files via the 1 cmd and 2 var1 parameters...