SQL Injection in AdRotate

High-Tech Bridge Security Research Lab discovered vulnerability in AdRotate, which can be exploited to perform SQL Injection attacks. 1 SQL Injection in AdRotate: CVE-2014-1854 The vulnerability exists due to insufficient validation of "track" HTTP GET parameter passed to...

Two Cross-Site Scripting (XSS) Vulnerabilities in Seo Panel

High-Tech Bridge Security Research Lab discovered two vulnerabilities in Seo Panel, which can be exploited to perform Cross-Site Scripting XSS attacks agains users of the vulnerable application to steal their sensitive data. 1 Two Cross-Site Scripting XSS in Seo Panel: CVE-2014-1855 1.1 The...

Multiple Vulnerabilities in Eventum

High-Tech Bridge Security Research Lab discovered vulnerability in Eventum, which can be exploited to reinstall and compromise vulnerable application. 1 Incorrect Default Permissions in Eventum: CVE-2014-1631 The vulnerability exists due to incorrect default permission set for installation script...

SQL Injection in doorGets CMS

High-Tech Bridge Security Research Lab discovered vulnerability in doorGets CMS, which can be exploited to perform SQL Injection attacks. 1 SQL Injection in doorGets CMS: CVE-2014-1459 The vulnerability exists due to insufficient validation of "positiondownid" HTTP POST parameter passed to...

Multiple SQL Injection Vulnerabilities in AuraCMS

High-Tech Bridge Security Research Lab discovered two SQL injection vulnerabilities in AuraCMS, which can be exploited to alter SQL queries and execute arbitrary SQL commands in application's database. 1 Multiple SQL Injection Vulnerabilities in AuraCMS: CVE-2014-1401 1.1 The vulnerability exists...

SQL Injection in JV Comment Joomla Extension

High-Tech Bridge Security Research Lab discovered SQL injection vulnerability in JV Comment Joomla Extension, which can be exploited to perform SQL Injection attacks. 1 SQL Injection in JV Comment Joomla Extension: CVE-2014-0794 The vulnerability exists due to insufficient validation of "id" HTTP...

Cross-Site Scripting (XSS) in Komento Joomla Extension

High-Tech Bridge Security Research Lab discovered two XSS vulnerabilities in Komento Joomla Extension, which can be exploited to perform script insertion attacks. 1 Cross-Site Scripting XSS in Komento Joomla Extension: CVE-2014-0793 1.1 The vulnerability exists due to insufficient sanitisation of...

SQL Injection in Sexy Polling Joomla Extension

High-Tech Bridge Security Research Lab discovered vulnerability in Sexy Polling Joomla Extension, which can be exploited to perform SQL Injection attacks. 1 SQL Injection in Sexy Polling Joomla Extension: CVE-2013-7219 The vulnerability exists due to insufficient validation of "answerid" HTTP POS...

Improper Authentication in Burden

High-Tech Bridge Security Research Lab discovered vulnerability in application authentication mechanism in Burden, which can be exploited by remote non-authenticated attacker to gain administrative access to the vulnerable application. 1 Improper Authentication in Burden: CVE-2013-7137 The...

Multiple Vulnerabilities in Horizon QCMS

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in Horizon QCMS, which can be exploited to read contents of arbitrary files and perform SQL Injection attacks. 1 Path Traversal in Horizon QCMS: CVE-2013-7138 The vulnerability exists due to insufficient filtration of...

Path Traversal in eduTrac

High-Tech Bridge Security Research Lab discovered path traversal vulnerability in eduTrac which can be exploited to read arbitrary files on vulnerable system with privileges of web server. 1 Path Traversal in eduTrac: CVE-2013-7097 The vulnerability exists due to insufficient filtration of...

Сross-Site Request Forgery (CSRF) in AskApache Firefox Adsense Wordpress plugin

High-Tech Bridge Security Research Lab discovered vulnerability in AskApache Firefox Adsense Wordpress plugin, which can be exploited to perform Сross-Site Request Forgery CSRF attacks. 1 Сross-Site Request Forgery CSRF in AskApache Firefox Adsense Wordpress plugin: CVE-2013-6992 The vulnerabilit...

Cross-Site Scripting (XSS) in WP-Cron Dashboard Wordpress plugin

High-Tech Bridge Security Research Lab discovered vulnerability in WP-Cron Dashboard Wordpress plugin, which can be exploited to perform Cross-Site Scripting XSS attacks. 1 Cross-Site Scripting XSS in WP-Cron Dashboard Wordpress plugin: CVE-2013-6991 The vulnerability exists due to insufficient...

Cross-Site Scripting (XSS) in Ad-minister Wordpress plugin

High-Tech Bridge Security Research Lab discovered vulnerability in Ad-minister Wordpress plugin, which can be exploited to perform Cross-Site Scripting XSS attacks. 1 Cross-Site Scripting XSS in Ad-minister Wordpress plugin: CVE-2013-6993 The vulnerability exists due to insufficient sanitisation ...

XSS and Full Path Disclosure in MijoSearch Joomla Extension

High-Tech Bridge Security Research Lab discovered 2 vulnerabilities in MijoSearch Joomla Extension, which can be exploited to gain access to potentially sensitive data and perform Cross-Site Scripting XSS attacks against users of vulnerable application. 1 Cross-site Scripting in MijoSearch:...

SQL Injection in InstantCMS

High-Tech Bridge Security Research Lab discovered blind SQL injection vulnerability in InstantCMS, which can be exploited to perform SQL Injection attacks, alter SQL requests and compromise vulnerable application. 1 SQL Injection in InstantCMS: CVE-2013-6839 The vulnerability exists due to...

Cross-Site Scripting (XSS) in Jamroom

High-Tech Bridge Security Research Lab discovered vulnerability in Jamroom, which can be exploited to perform Cross-Site Scripting XSS attacks. 1 Cross-Site Scripting XSS in Jamroom: CVE-2013-6804 The vulnerability exists due to insufficient sanitisation of user-supplied data in "searchstring" HT...

User Identity Spoofing in Bitrix Site Manager

High-Tech Bridge Security Research Lab discovered vulnerability in Bitrix Site Manager, which can be exploited to spoof user's identity and read, modify or delete pre-ordered items in customer's basket. 1 User Identity Spoofing in Bitrix Site Manager: CVE-2013-6788 The vulnerability exists due to...

SQL Injection in Chamilo LMS

High-Tech Bridge Security Research Lab discovered vulnerability in Chamilo LMS, which can be exploited to perform SQL Injection attacks. 1 SQL Injection in Chamilo LMS: CVE-2013-6787 The vulnerability exists due to insufficient validation of "password0" HTTP POST parameter passed to...

SQL Injection in Dokeos

High-Tech Bridge Security Research Lab discovered vulnerability in Dokeos, which can be exploited to perform SQL Injection attacks. 1 SQL Injection in Dokeos: CVE-2013-6341 The vulnerability exists due to insufficient validation of "language" HTTP GET parameter passed to "/index.php" script. A...

Cross-Site Scripting (XSS) in Tweet Blender Wordpress Plugin

High-Tech Bridge Security Research Lab discovered vulnerability in Tweet Blender Wordpress Plugin, which can be exploited to perform Cross-Site Scripting XSS attacks. 1 Cross-Site Scripting XSS in Tweet Blender Wordpress Plugin: CVE-2013-6342 1.1 The vulnerability exists due to insufficient...

Multiple Cross-Site Scripting (XSS) in Claroline

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in Claroline, which can be exploited to perform Cross-Site Scripting XSS attacks against vulnerable web application visitors and administrators. 1 Cross-Site Scripting XSS in Claroline: CVE-2013-6267 1.1 The vulnerability...

Cross-Site Scripting (XSS) in Zikula Application Framework

High-Tech Bridge Security Research Lab discovered vulnerability in Zikula Application Framework, which can be exploited to perform Cross-Site Scripting XSS attacks. 1 Cross-Site Scripting XSS in Zikula Application Framework: CVE-2013-6168 1.1 The vulnerability exists due to insufficient...

SQL Injection in appRain

High-Tech Bridge Security Research Lab discovered vulnerability in appRain, which can be exploited to perform SQL Injection attacks. 1 Blind SQL Injection in appRain: CVE-2013-6058 The vulnerability is caused by insufficient validation of user-supplied data appended to "/blog-by-cat/" URL. Remote...

Cross-Site Scripting (XSS) in GuppY

High-Tech Bridge Security Research Lab discovered two XSS vulnerabilities in GuppY, which can be exploited to perform Cross-Site Scripting attacks against users of vulnerable application. 1 Cross-Site Scripting XSS in GuppY: CVE-2013-5983 1.1 The vulnerability exists due to insufficient...

Remote Code Execution in Microweber

High-Tech Bridge Security Research Lab discovered vulnerability in Microweber, which can be exploited to delete arbitrary files and compromise vulnerable system as a consequence. 1 Improper Access Control in Microweber: CVE-2013-5984 Vulnerability exists due to improper access restriction to...

Cross-Site Scripting (XSS) in Feng Office

High-Tech Bridge Security Research Lab discovered vulnerability in Feng Office, which can be exploited to perform Cross-Site Scripting XSS attacks against users of vulnerable application. 1 Cross-Site Scripting XSS in Feng Office: CVE-2013-5744 1.1 The vulnerability exists due to insufficient...

Remote Code Execution in GLPI

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in GLPI, which can be exploited to bypass security restrictions and execute arbitrary PHP code with privileges of web server. 1 Improper Access Control in GLPI The vulnerability exists due to insufficient access restrictio...

Multiple Vulnerabilities in X2CRM

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in X2CRM, which can be exploited to include arbitrary local files and execute arbitrary PHP code, as well as to perform Cross-Site Sripting XSS attacks against users of vulnerable application. 1 PHP File Inclusion in X2CRM...

Multiple Vulnerabilities in Gnew

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in Gnew, which can be exploited to execute arbitrary PHP code and pefrom SQL injection attacks against vulnerable application. 1 PHP File Inclusion in Gnew: CVE-2013-5639 Vulnerability exists due to insufficient validation...

Cross-Site Scripting (XSS) in WikkaWiki

High-Tech Bridge Security Research Lab discovered vulnerability in WikkaWiki, which can be exploited to perform Cross-Site Scripting XSS attacks against users of vulnerable application. 1 Cross-Site Scripting XSS in WikkaWiki: CVE-2013-5586 The vulnerability exists due to insufficient sanitisatio...

SQL Injection in vtiger CRM

High-Tech Bridge Security Research Lab discovered SQL injection vulnerability in vtiger CRM, which can be exploited to execute arbitrary SQL commands in application's database. 1 SQL Injection in vtiger CRM: CVE-2013-5091 The vulnerability exists due to insufficient validation of "onlyforuser" HT...

Improper Access Control in Collabtive

High-Tech Bridge SA Security Research Lab has discovered vulnerability in Collabtive, which can be exploited to gain complete control over the application. 1 Improper Access Control in Collabtive: CVE-2013-5027 The vulnerability exists due to improper access restrictions to the third installation...

Path Traversal in DeWeS Web Server (Twilight CMS)

High-Tech Bridge Security Research Lab discovered path traversal vulnerability in DeWeS web server that is supplied in package with Twilight CMS Windows version, which can be exploited to read arbitrary files on vulnerable system. 1 Path Traversal in DeWeS Web Server: CVE-2013-4900 The...

Cross-Site Scripting (XSS) in Twilight CMS

High-Tech Bridge Security Research Lab discovered vulnerability in Twilight CMS, which can be exploited to perform Cross-Site Scripting XSS attacks. 1 Cross-Site Scripting XSS in Twilight CMS: CVE-2013-4899 The vulnerability exists due to insufficient filtration of user-supplied data appended to...

Multiple Vulnerabilities in BigTree CMS

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in BigTree CMS, which can be exploited to perform SQL injection, Cross-Site Scripting XSS and Cross-Site Request Forgery CSRF attacks. A remote attacker can add, modify or delete information in application's database and...

SQL Injection in Cotonti

High-Tech Bridge Security Research Lab discovered vulnerability in Cotonti, which can be exploited to perform SQL injection attacks against vulnerable application. A remote attacker can read, modify or delete data in application’s database and even gain complete control over the application under...

Cross-Site Scripting (XSS) in Magnolia CMS

High-Tech Bridge Security Research Lab discovered XSS vulnerability in Magnolia CMS, which can be exploited to perform Cross-Site Scripting attacks against users of vulnerable application. 1 Cross-Site Scripting XSS in Magnolia CMS: CVE-2013-4759 The vulnerability exists due to insufficient...

Cross-Site Scripting (XSS) in BackWPup WordPress Plugin

High-Tech Bridge Security Research Lab discovered XSS vulnerability in BackWPup WordPress Plugin, which can be exploited to perform cross-site scripting attacks against administrator of vulnerable application. 1 Cross-Site Scripting XSS in BackWPup WordPress Plugin: CVE-2013-4626 The vulnerabilit...

Cross-Site Scripting (XSS) in Duplicator WordPress Plugin

High-Tech Bridge Security Research Lab discovered XSS vulnerability in Duplicator WordPress plugin, which can be exploited to perform cross-site scripting attacks against vulnerable application. 1 Cross-Site Scripting XSS in Duplicator WordPress Plugin: CVE-2013-4625 The vulnerability exists due ...

XSS Vulnerabilities in OpenCms

High-Tech Bridge Security Research Lab discovered 2 XSS vulnerabilities in OpenCms, which can be exploited to perform Cross-Site Scripting attacks against users of vulnerable application. 1 Multiple Cross-Site Scripting XSS in OpenCms: CVE-2013-4600 1.1 The vulnerability exists due to insufficien...

Multiple XSS Vulnerabilities in Jahia xCM

High-Tech Bridge Security Research Lab discovered multiple XSS vulnerabilities in Jahia xCM, which can be exploited to perform cross-site scripting attacks against administrator of vulnerable application. 1 Multiple Cross-Site Scripting XSS Vulnerabilites in Jahia xCM: CVE-2013-4624 1.1 The...

Multiple Vulnerabilities in Kasseler CMS

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in Kasseler CMS, which can be exploited to perform SQL injection, Cross-Site Scripting XSS and Cross-Site Request Forgery CSRF attacks and compromise vulnerable application. 1 SQL Injection in Kasseler CMS: CVE-2013-3727 T...

SQL Injection in Dolphin | HTB23157

High-Tech Bridge Security Research Lab discovered SQL injection vulnerability in Dolphin, which can be exploited to manipulate SQL requests passed to vulnerable application and obtain sensitive data from the database. 1 SQL Injection in Dolphin: CVE-2013-3638 The vulnerability exists due to...

Multiple XSS Vulnerabilities in Xaraya

High-Tech Bridge Security Research Lab discovered four XSS vulnerabilities in Xaraya, which can be exploited to perform cross-site scripting attacks against administrators of vulnerable application. 1 Multiple Cross-Site Scripting XSS in Xaraya: CVE-2013-3639 1.1 The vulnerability exists due to...

Multiple Vulnerabilities in OpenX

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in OpenX, which can be exploited to execute arbitrary PHP code, perform Cross-Site Scripting XSS attacks and compromise vulnerable system. 1 Local File Inclusion in OpenX: CVE-2013-3514 Input passed via "group" HTTP GET...

Multiple Vulnerabilities in Exponent CMS

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in Exponent CMS, which can be exploited to execute arbitrary SQL commands in the database of vulnerable application and execute arbitrary PHP code on the vulnerable system. 1 SQL Injection in Exponent CMS: CVE-2013-3294 Th...

Multiple Vulnerabilities in Jojo CMS

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in Jojo CMS, which can be exploited to perform SQL Injection and Cross-Site Scripting XSS attacks. 1 SQL Injection in Jojo CMS: CVE-2013-3081 The vulnerability is caused by insufficient filtration of user-supplied input...

SQL Injection in b2evolution

High-Tech Bridge Security Research Lab discovered SQL injection vulnerability in b2evolution, which can be exploited to alter SQL requests passed to the vulnerable application's database. 1 SQL Injection in b2evolution: CVE-2013-2945 The vulnerability exists due to insufficient validation of HTTP...

Cross-Site Request Forgery (CSRF) in UMI.CMS

High-Tech Bridge Security Research Lab discovered CSRF vulnerability in UMI.CMS, which can be exploited to perform Cross-Site Request Forgery CSRF attacks and create new administrator in the vulnerable application. 1 Cross-site Request Forgery CSRF in UMI.CMS: CVE-2013-2754 The application allows...