EUVD-2014-8832

Malware in sbrugna...

EUVD-2014-8833

Malware in sbrugna...

vldpersonals.com Cross Site Scripting vulnerability OBB-2708231

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2014-9005

Multiple SQL injection vulnerabilities in vldPersonals before 2.7.1 allow remote attackers to execute arbitrary SQL commands via the 1 country, 2 gender1, or 3 gender2 parameter in a search action to index.php...

CVE-2014-9004

Cross-site scripting XSS vulnerability in vldPersonals before 2.7.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter in a memberprofile action to index.php...

Cross site scripting

Cross-site scripting XSS vulnerability in vldPersonals before 2.7.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter in a memberprofile action to index.php...

Sql injection

Multiple SQL injection vulnerabilities in vldPersonals before 2.7.1 allow remote attackers to execute arbitrary SQL commands via the 1 country, 2 gender1, or 3 gender2 parameter in a search action to index.php...

CVE-2014-9004

This CVE concerns the Web app component vldPersonals. Affected version: before 2.7.1. Root cause: a Cross‑Site Scripting (XSS) vulnerability in the member_profile action of index.php, exploitable via the id parameter. Impact: remote attackers can inject arbitrary web scripts or HTML, potentially ...

CVE-2014-9005

CVE-2014-9005 affects vldPersonals up to version 2.7.1, where SQL injection is possible via the search action in index.php through the parameters country, gender1, or gender2, allowing remote command execution. Root cause: improper handling of input in these parameters leading to SQL injection. T...

CVE-2014-9004

Cross-site scripting XSS vulnerability in vldPersonals before 2.7.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter in a memberprofile action to index.php...

CVE-2014-9005

Multiple SQL injection vulnerabilities in vldPersonals before 2.7.1 allow remote attackers to execute arbitrary SQL commands via the 1 country, 2 gender1, or 3 gender2 parameter in a search action to index.php...

CVE-2014-9004: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in vldPersonals before 2.7.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter in a memberprofile action to index.php...

CVE-2014-9005: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in vldPersonals before 2.7.1 allow remote attackers to execute arbitrary SQL commands via the 1 country, 2 gender1, or 3 gender2 parameter in a search action to index.php...

PT-2014-8784

Name of the Vulnerable Software and Affected Versions vldPersonals versions prior to 2.7.1 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the country, gender1, or gender2 parameter in a search action to "index.php". Recommendations For...

PT-2014-8783

Name of the Vulnerable Software and Affected Versions vldPersonals versions prior to 2.7.1 Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the id parameter in a "member profile" action to "index.php". Recommendations For versions prior t...