Cross-site Scripting (XSS) Vulnerabilities in Zimplit CMS

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Zimplit CMS which could be exploited to perform cross-site scripting attacks. 1 Cross-site scripting XSS vulnerabilities in Zimplit CMS: CVE-2010-4513 1.1 The vulnerability exists due to input sanitation error in...

Cross-site Scripting (XSS) Vulnerability in Pligg CMS

High-Tech Bridge SA Security Research Lab has discovered vulnerability in Pligg CMS which could be exploited to perform cross-site scripting attacks. 1 Cross-site scripting XSS vulnerability in Pligg CMS The vulnerability exists due to input sanitation error in the "search" parameter in...

Multiple Cross-site Scripting Vulnerabilities in GetSimple CMS

High-Tech Bridge SA Security Research Lab has discovered two vulnerabilities in GetSimple CMS which could be exploited to perform cross-site scripting attacks. 1 Cross-site scripting vulnerability in GetSimple CMS: CVE-2010-5052 The vulnerability exists due to input sanitation error in the "val"...

Improper Access Control in ArticleFR

High-Tech Bridge Security Research Lab discovered vulnerability in ArticleFR, which can be exploited to execute arbitrary UPDATE SQL statements, alter information stored in database and gain complete control over the web site. 1 Improper Access Control in ArticleFR: CVE-2014-4170 The vulnerabilit...

Local File Inclusion in PluXml

High-Tech Bridge SA Security Research Lab has discovered vulnerabiliy in PluXml, which can be exploited to perform Local File Inclusion attacks. 1 Local File Inclusion in PluXml 1.1 Input passed via the "defaultlang" POST parameter to /update/index.php is not properly verified before being used i...

Multiple XSS in Dotclear

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Dotclear, which can be exploited to perform Cross-Site Scripting XSS attacks. 1 Cross-Site Scripting XSS in Dotclear: CVE-2012-1039 1.1 Input passed via the "logindata" POST parameter to /admin/auth.php is not...

Multiple vulnerabilities in ImpressCMS

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in ImpressCMS, which can be exploited to perform cross-site scripting and local file inclusion attacks. 1 Multiple Arbitrary XSS vulnerabilities in ImpressCMS: CVE-2012-0986 1.1 Input appended to the URL after...

Multiple Vulnerabilities in BLOG:CMS

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in BLOG:CMS which could be exploited to perform cross-site scripting, script insertion and cross-site request forgery attacks. 1 Cross-site scripting XSS vulnerabilities in BLOG:CMS: CVE-2010-4749 1.1 The...

Cross-site Scripting (XSS) Vulnerability in NinkoBB

High-Tech Bridge SA Security Research Lab has discovered vulnerability in NinkoBB which could be exploited to perform cross-site scripting attacks. 1 Cross-site scripting XSS vulnerability in NinkoBB: CVE-2010-4874 The vulnerability exists due to input sanitation error in parameters...

Reflected Cross-Site Scripting (XSS) in BlackCat CMS

High-Tech Bridge Security Research Lab discovered vulnerability in BlackCat CMS, which can be exploited to perform Cross-Site Scripting XSS attacks. 1 Reflected Cross-Site Scripting XSS in BlackCat CMS: CVE-2014-5259 The vulnerability exists due to insufficient sanitization of the "msg" HTTP GET...

SQL Injection Vulnerability in ArticleFR

High-Tech Bridge Security Research Lab discovered SQL injection vulnerability in ArticleFR, which can be exploited to perform SQL Injection attacks and gain complete control over vulnerable website. 1 SQL Injection in ArticleFR: CVE-2014-5097 The vulnerability exists due to insufficient...

Сross-Site Request Forgery (CSRF) in AskApache Firefox Adsense Wordpress plugin

High-Tech Bridge Security Research Lab discovered vulnerability in AskApache Firefox Adsense Wordpress plugin, which can be exploited to perform Сross-Site Request Forgery CSRF attacks. 1 Сross-Site Request Forgery CSRF in AskApache Firefox Adsense Wordpress plugin: CVE-2013-6992 The vulnerabilit...

Path Traversal in AWS XMS

High-Tech Bridge Security Research Lab discovered path traversal vulnerability in AWS XMS, which can be exploited to read contents of arbitrary files. 1 Path Traversal in AWS XMS: CVE-2013-2474 The vulnerability exists due to insufficient filtration of "what" HTTP GET parameter passed to...

Multiple XSS vulnerabilities in Events Manager WordPress plugin

High-Tech Bridge Security Research Lab discovered multiple XSS vulnerabilities in Events Manager WordPress plugin, which can be exploited to perform Cross-Site Scripting attacks. 1 Multiple XSS vulnerabilities in Events Manager WordPress plugin: CVE-2013-1407 1.1 The vulnerability exists due to...

Multiple Vulnerabilities in LibreOffice

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in LibreOffice which could be exploited to perform denial of service DoS attacks. 1 Multiple vulnerabilities in LibreOffice: CVE-2012-4233 1.1 NULL pointer dereference error was found in the vcllo.dll while processi...

Local File Inclusion Vulnerabilities in vtiger CRM

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in vtiger CRM which could be exploited to perform gain access to sensitive information and compromise vulnerable system. 1 Local file inclusion vulnerabilities in vtiger CRM 1.1 The vulnerability exists due to input...

Directory Traversal Vulnerability in SoftX FTP Client

High-Tech Bridge SA Security Research Lab has discovered vulnerability in SoftX FTP Client which could be exploited to execute arbitrary code on vulnerable system. 1 Directory Traversal Vulnerability in SoftX FTP Client: CVE-2010-3096 The vulnerability exists due to insufficient sanitation of the...

Сross-Site Request Forgery (CSRF) in XCloner Standalone

High-Tech Bridge Security Research Lab discovered vulnerability in XCloner Standalone, which can be exploited to perform Сross-Site Request Forgery CSRF attacks and gain complete control over the website. 1. Сross-Site Request Forgery CSRF in XCloner Standalone: CVE-2014-2579 1.1 The vulnerabilit...

Cross-Site Scripting (XSS) in Open Classifieds

High-Tech Bridge Security Research Lab discovered vulnerability in Open Classifieds, which can be exploited to perform Cross-Site Scripting XSS attacks. 1 Cross-Site Scripting XSS in Open Classifieds: CVE-2014-2024 The vulnerability exists due to insufficient sanitisation of user-supplied data...

Multiple Vulnerabilities in Horizon QCMS

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in Horizon QCMS, which can be exploited to read contents of arbitrary files and perform SQL Injection attacks. 1 Path Traversal in Horizon QCMS: CVE-2013-7138 The vulnerability exists due to insufficient filtration of...

Cross-Site Scripting (XSS) in Zikula Application Framework

High-Tech Bridge Security Research Lab discovered vulnerability in Zikula Application Framework, which can be exploited to perform Cross-Site Scripting XSS attacks. 1 Cross-Site Scripting XSS in Zikula Application Framework: CVE-2013-6168 1.1 The vulnerability exists due to insufficient...

SQL Injection in Dolphin | HTB23157

High-Tech Bridge Security Research Lab discovered SQL injection vulnerability in Dolphin, which can be exploited to manipulate SQL requests passed to vulnerable application and obtain sensitive data from the database. 1 SQL Injection in Dolphin: CVE-2013-3638 The vulnerability exists due to...

Multiple XSS Vulnerabilities in Xaraya

High-Tech Bridge Security Research Lab discovered four XSS vulnerabilities in Xaraya, which can be exploited to perform cross-site scripting attacks against administrators of vulnerable application. 1 Multiple Cross-Site Scripting XSS in Xaraya: CVE-2013-3639 1.1 The vulnerability exists due to...

Cross-Site Request Forgery (CSRF) in CMS Made Simple

High-Tech Bridge Security Research Lab discovered vulnerability in CMS Made Simple, which can be exploited to perform cross-site request forgery CSRF attacks. 1. Сross-Site Request Forgery CSRF in CMS Made Simple: CVE-2012-5450 The application allows authorized administrator to perform certain...

Multiple vulnerabilities in OpenX

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in OpenX, which can be exploited to perform Cross-Site Scripting XSS and SQL Injection attacks. 1 Cross-Site Scripting XSS in OpenX: CVE-2012-4989 Input passed via the "parent" GET parameter to /www/admin/plugin-index.php ...

Blind SQL Injection in Webmatic

High-Tech Bridge SA Security Research Lab has discovered vulnerability in Webmatic, which can be exploited to perform Blind SQL Injection attacks. 1 Blind SQL Injection in Webmatic: CVE-2012-3350 1.1 Input passed via the "Referer:" field of the HTTP header to index.php is not properly sanitised...

Buffer Overflow in HP Device Access Manager for Protect Tools Information Store

High-Tech Bridge SA Security Research Lab has discovered vulnerabilities in HP Device Access Manager for Protect Tools Information Store which could be exploited to compromise vulnerable system. 1 Buffer overflow in HP Device Access Manager for Protect Tools Information Store: CVE-2011-4162 The...

Cross-site Scripting (XSS) Vulnerability in PhotoSmash

High-Tech Bridge SA Security Research Lab has discovered vulnerability in PhotoSmash WordPress plugin which could be exploited to perform cross-site scripting attacks. 1 Cross-site scripting XSS vulnerability in PhotoSmash The vulnerability exists due to input sanitation error in the "action"...

Multiple Vulnerabilities in VaM Shop

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in VaM Shop which could be exploited to perform cross-site scripting and cross-site request forgery attacks. 1 Cross-site scripting XSS vulnerabilities in VaM Shop: CVE-2011-0504 1.1 The vulnerability exists due to...

Multiple Vulnerabilities in boastMachine

High-Tech Bridge SA Security Research Lab has discovered two vulnerabilities in boastMachine which could be exploited to perform cross-site scripting attacks and execute arbitrary SQL commands in applications database. 1 Cross-site scripting XSS vulnerability in boastMachine The vulnerability...

Multiple Vulnerabilities in LiSK CMS

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in LiSK CMS which could be exploited to perform cross-site scripting attacks and execute arbitrary SQL commands in applications database. 1 Cross-site scripting XSS vulnerability in LiSK CMS: CVE-2010-2013 The...

SQL Injection in InstantCMS

High-Tech Bridge Security Research Lab discovered blind SQL injection vulnerability in InstantCMS, which can be exploited to perform SQL Injection attacks, alter SQL requests and compromise vulnerable application. 1 SQL Injection in InstantCMS: CVE-2013-6839 The vulnerability exists due to...

SQL Injection in b2evolution

High-Tech Bridge Security Research Lab discovered SQL injection vulnerability in b2evolution, which can be exploited to alter SQL requests passed to the vulnerable application's database. 1 SQL Injection in b2evolution: CVE-2013-2945 The vulnerability exists due to insufficient validation of HTTP...

OS Command Injection in CosCms

High-Tech Bridge Security Research Lab discovered vulnerability in CosCms, which can be exploited to execute arbitrary OS commands on web server where the vulnerable application is hosted. 1 OS Command Injection in CosCms: CVE-2013-1668 Vulnerability exists due to insufficient validation of...

Cross-Site Scripting (XSS) vulnerability in Quick.Cms and Quick.Cart

High-Tech Bridge Security Research Lab discovered XSS vulnerability in Quick.Cms and Quick.Cart - two products developed by OpenSolution team, which can be exploited to perform cross-site scripting attacks. 1. Cross-Site Scripting XSS vulnerability in Quick.Cms and Quick.Cart: CVE-2012-6430 The...

Multiple vulnerabilities in jCore

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in jCore, which can be exploited to perform Cross-Site Scripting XSS and SQL Injection attacks. 1 SQL Injection in jCore: CVE-2012-4232 1.1 Input passed via the "memberloginid" COOKIE parameter to /admin/index.php is not...

Multiple vulnerabilities in Pligg CMS

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Pligg CMS , which can be exploited to perform Cross-Site Scripting XSS and Local File Inclusion attacks. 1 Multiple Cross-Site Scripting XSS in Pligg CMS: CVE-2012-2436 1.1 Input passed via the arbitrary any GET...

Multiple vulnerabilities in OrangeHRM

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in OrangeHRM, which can be exploited to perform SQL Injection and Cross-Site Scripting XSS attacks. 1 SQL Injection in OrangeHRM: CVE-2012-1506 1.1 Input passed via the "hspSummaryId" GET parameter to...

Cross-site Scripting (XSS) Vulnerability in FlatPress

High-Tech Bridge SA Security Research Lab has discovered vulnerability in FlatPress which could be exploited to perform cross-site scripting attacks. 1 Cross-site scripting XSS vulnerability in FlatPress The vulnerability exists due to input sanitation error in the "name", "email" and "url"...

Cross-site Request Forgery (CSRF) in phpCollab

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in phpCollab which can be exploited to perform cross-site request forgery attacks. 1 Cross-site request forgery CSRF in phpCollab 1.1 The vulnerability exists due to insufficient validation of the request origin in...

Self-XSS in Microsoft Dynamics CRM 2013 SP1

High-Tech Bridge Security Research Lab discovered a DOM-based self-XSS vulnerability in Microsoft Dynamics CRM 2013 SP1, which can be exploited to perform Cross-Site Scripting attacks against authenticated users. The vulnerability exists due to insufficient filtration of user-supplied input passe...

Reflected Cross-Site Scripting (XSS) in MaxButtons WordPress Plugin

High-Tech Bridge Security Research Lab discovered vulnerability in MaxButtons WordPress plugin, which can be exploited to perform Cross-Site Scripting XSS attacks against logged-in administrator. 1 Reflected Cross-Site Scripting XSS in MaxButtons wordpress plugin: CVE-2014-7181 Input passed via t...

Multiple Cross-Site Scripting (XSS) in Claroline

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in Claroline, which can be exploited to perform Cross-Site Scripting XSS attacks against vulnerable web application visitors and administrators. 1 Cross-Site Scripting XSS in Claroline: CVE-2013-6267 1.1 The vulnerability...

Improper Access Control in Collabtive

High-Tech Bridge SA Security Research Lab has discovered vulnerability in Collabtive, which can be exploited to gain complete control over the application. 1 Improper Access Control in Collabtive: CVE-2013-5027 The vulnerability exists due to improper access restrictions to the third installation...

Multiple SQL Injection Vulnerabilities in Elite Bulletin Board

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in Elite Bulletin Board, which can be exploited to perform SQL injection attacks. 1 Multiple SQL injection vulnerabilities in Elite Bulletin Board: CVE-2012-5874 The vulnerabilities exist due to insufficient sanitation of...

Multiple vulnerabilities in Subrion CMS

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in Subrion CMS, which can be exploited to perform Cross-Site Scripting XSS, SQL Injection and Сross-Site Request Forgery CSRF attacks. 1 SQL Injection in Subrion CMS: CVE-2012-4772 Input passed via the "planid" POST...

Multiple XSS in pragmaMx

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in pragmaMx, which can be exploited to perform Cross-Site Scripting XSS attacks. 1 Multiple Cross-Site Scripting XSS in pragmaMx: CVE-2012-2452 1.1 Input passed via a name of a GET parameter to modules.php is not...

Multiple vulnerabilities in Piwigo

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Piwigo, which can be exploited to perform Cross-Site Scripting XSS and Path Traversal attacks. 1 Directory Path Traversal in Piwigo: CVE-2012-2208 1.1 Input passed via the "language" GET parameter to upgrade.php ...

SQL Injection Vulnerability in ExtCalendar 2

High-Tech Bridge SA Security Research Lab has discovered vulnerability in ExtCalendar 2 which could be exploited to perform SQL injection attacks. 1 SQL injection vulnerability in ExtCalendar 2 The vulnerability exists due to input sanitation errors in the "search" parameter in calsearch.php. A...

SQL Injection Vulnerabilities in WP Forum wordpress plugin

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in WP Forum wordpress plugin which could be exploited to perform SQL injection attacks. 1 SQL injection vulnerabilities in WP Forum wordpress plugin 1.1 The vulnerability exists due to input sanitation error in the...