PT-2017-18873

Name of the Vulnerable Software and Affected Versions WebsiteBaker version 2.10.0 Description The issue is related to a stored XSS vulnerability. It affects the /account/details.php endpoint. Recommendations For version 2.10.0, update to a newer version that contains a fix for this issue. At the...

CVE-2017-9361: Improper Neutralization of Input During Web Page Generation

WebsiteBaker v2.10.0 has a stored XSS vulnerability in /account/details.php...

CVE-2017-9360: Improper Neutralization of Special Elements used in an SQL Command

WebsiteBaker v2.10.0 has a SQL injection vulnerability in /account/details.php...

Multiple SQL Injection Vulnerabilities in WebsiteBaker

websitebaker is an open source content management system CMS. Websitebaker has multiple SQL injection vulnerabilities. Because account/signup.php does not properly handle the values of the variables "username" and "displayname", a remotely authenticated attacker registration is turned on by defau...

CVE-2017-7410

Multiple SQL injection vulnerabilities in account/signup.php and account/signup2.php in WebsiteBaker 2.10.0 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 username, 2 displayname parameter...

CVE-2017-7410

Multiple SQL injection vulnerabilities in account/signup.php and account/signup2.php in WebsiteBaker 2.10.0 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 username, 2 displayname parameter...

Sql injection

Multiple SQL injection vulnerabilities in account/signup.php and account/signup2.php in WebsiteBaker 2.10.0 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 username, 2 displayname parameter...

CVE-2017-7410

CVE-2017-7410 affects WebsiteBaker 2.10.0 and earlier. Multiple SQL injection vulnerabilities exist in account/signup.php and account/signup2.php where the username and display_name parameters allow remote attackers to alter the SQL query and execute arbitrary SQL commands. Public metrics indicat...

CVE-2017-7410

Multiple SQL injection vulnerabilities in account/signup.php and account/signup2.php in WebsiteBaker 2.10.0 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 username, 2 displayname parameter...

PT-2017-17718

Name of the Vulnerable Software and Affected Versions WebsiteBaker versions 2.10.0 and earlier Description The issue concerns SQL injection vulnerabilities in certain PHP files. These vulnerabilities allow remote attackers to execute arbitrary SQL commands via the username and display name...

CVE-2017-7410: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in account/signup.php and account/signup2.php in WebsiteBaker 2.10.0 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 username, 2 displayname parameter...

WebsiteBaker CMS 2.8.3-SP5 SQL Injection

Advisory ID: HTB23296 Product: WebsiteBaker Vendor: WebsiteBaker Org e.V. Vulnerable Versions: 2.8.3-SP5 and probably prior Tested Version: 2.8.3-SP5 Advisory Publication: February 24, 2016 without technical details Vendor Notification: February 24, 2016 Vendor Patch: February 26, 2016 Public...

Websitebaker SQL Injection Vulnerability (CNVD-2016-01767)

websitebaker is an open source content management system CMS. Websitebaker suffers from a SQL injection vulnerability. Due to the failure of the PHP script to filter user-supplied data via the "language" HTTP POST parameter passed to "/account/preferences.php", a remotely authenticated attacker...

SQL Injection and RCE in WebsiteBaker

High-Tech Bridge Security Research Lab discovered SQL injection vulnerability in WebsiteBaker CMS. A remote attacker will be able to read, write or modify arbitrary information in the database, gain complete control over the vulnerable web application and even the entire web server on which the...

CVE-2015-0553

Cross-site scripting XSS vulnerability in admin/pages/modify.php in WebsiteBaker 2.8.3 SP3 allows remote attackers to inject arbitrary web script or HTML via the pageid parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in admin/pages/modify.php in WebsiteBaker 2.8.3 SP3 allows remote attackers to inject arbitrary web script or HTML via the pageid parameter...

CVE-2015-0553

Affects WebsiteBaker 2.8.3 SP3: admin/pages/modify.php exposes a reflecting XSS via the page_id parameter. Impact is script execution in the context of the user’s browser. No remediation details are provided in the connected documents; CVSSv2 base score is 4.3 (Medium). Exploitation details appea...

CVE-2015-0553

Cross-site scripting XSS vulnerability in admin/pages/modify.php in WebsiteBaker 2.8.3 SP3 allows remote attackers to inject arbitrary web script or HTML via the pageid parameter...

CVE-2015-0553

Cross-site scripting XSS vulnerability in admin/pages/modify.php in WebsiteBaker 2.8.3 SP3 allows remote attackers to inject arbitrary web script or HTML via the pageid parameter...

CVE-2015-0553: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/pages/modify.php in WebsiteBaker 2.8.3 SP3 allows remote attackers to inject arbitrary web script or HTML via the pageid parameter...