Multiple Cross-Site Scripting (XSS) in Kajona

High-Tech Bridge Security Research Lab has discovered multiple Cross-Site Scripting XSS vulnerabilities in Kajona. 1 Multiple Cross-Site Scripting XSS in Kajona: CVE-2012-3805 1.1 Input passed via the "absendername", "absenderemail" and "absendernachricht" GET parameters to /index.php when "page"...

Blind SQL Injection in Webmatic

High-Tech Bridge SA Security Research Lab has discovered vulnerability in Webmatic, which can be exploited to perform Blind SQL Injection attacks. 1 Blind SQL Injection in Webmatic: CVE-2012-3350 1.1 Input passed via the "Referer:" field of the HTTP header to index.php is not properly sanitised...

Cross-Site Scripting (XSS) in Kayako Fusion

High-Tech Bridge SA Security Research Lab has discovered vulnerability in Kayako Fusion, which can be exploited to perform Cross-Site Scripting XSS attacks. 1 Cross-Site Scripting XSS in Kayako Fusion: CVE-2012-3233 Input appended to the URL after...

Multiple vulnerabilities in web@all

High-Tech Bridge Security Research Lab has discovered multiple vulnerabilities in web@all, which can be exploited to perform Сross-Site Request Forgery CSRF and Cross-Site Scripting XSS attacks. 1 Сross-Site Request Forgery CSRF in web@all: CVE-2012-3231 1.1 The application allows authorized...

Multiple vulnerabilities in TinyWebGallery

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in TinyWebGallery, which can be exploited to perform Сross-Site Request Forgery CSRF, Arbitrary Code Execution and Cross-Site Scripting XSS attacks. 1 Сross-Site Request Forgery CSRF in TinyWebGallery: CVE-2012-2930...

SQL injection in Serendipity

High-Tech Bridge SA Security Research Lab has discovered vulnerability in Serendipity, which can be exploited to perform SQL injection attacks. 1 SQL injection in Serendipity 1.1 Input passed via the "url" GET parameter to comment.php is not properly sanitised before being used in a SQL query. Th...

XSS in PrestaShop

High-Tech Bridge SA Security Research Lab has discovered vulnerability in PrestaShop, which can be exploited to perform Cross-Site Scripting XSS attacks. 1 Cross-Site Scripting XSS in PrestaShop Input passed via the "product" POST parameter to ajax.php is not properly sanitised before being...

Multiple XSS in pragmaMx

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in pragmaMx, which can be exploited to perform Cross-Site Scripting XSS attacks. 1 Multiple Cross-Site Scripting XSS in pragmaMx: CVE-2012-2452 1.1 Input passed via a name of a GET parameter to modules.php is not...

Multiple vulnerabilities in Pligg CMS

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Pligg CMS , which can be exploited to perform Cross-Site Scripting XSS and Local File Inclusion attacks. 1 Multiple Cross-Site Scripting XSS in Pligg CMS: CVE-2012-2436 1.1 Input passed via the arbitrary any GET...

Cross-Site Scripting (XSS) in Pivotx

High-Tech Bridge SA Security Research Lab has discovered vulnerabiliy in Pivotx, which can be exploited to perform Cross-Site Scripting XSS attacks. 1 Cross-Site Scripting XSS in Pivotx: CVE-2012-2274 1.1 Input passed via the "file" GET parameter to /pivotx/ajaxhelper.php is not properly sanitise...

Сross-Site Request Forgery (CSRF) in TestLink

High-Tech Bridge Security Research Lab has discovered vulnerabiliy in TestLink, which can be exploited to perform Сross-Site Request Forgery CSRF attacks. 1 Сross-Site Request Forgery CSRF in TestLink: CVE-2012-2275 The application allows authorized users to perform certain actions via HTTP...

Local File Inclusion in PluXml

High-Tech Bridge SA Security Research Lab has discovered vulnerabiliy in PluXml, which can be exploited to perform Local File Inclusion attacks. 1 Local File Inclusion in PluXml 1.1 Input passed via the "defaultlang" POST parameter to /update/index.php is not properly verified before being used i...

Multiple vulnerabilities in Piwigo

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Piwigo, which can be exploited to perform Cross-Site Scripting XSS and Path Traversal attacks. 1 Directory Path Traversal in Piwigo: CVE-2012-2208 1.1 Input passed via the "language" GET parameter to upgrade.php ...

Multiple vulnerabilities in Newscoop

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Newscoop, which can be exploited to perform Remote File Inclusion, SQL Injection and Cross-Site Scripting XSS attacks. 1 Multiple Remote File Inclusion in Newscoop: CVE-2012-1933 1.1 Input passed via the...

Multiple XSS vulnerabilities in All-in-One Event Calendar Plugin for WordPress

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in All-in-One Event Calendar Plugin for WordPress, which can be exploited to perform Cross-Site Scripting XSS attacks. 1 Cross-Site Scripting XSS in All-in-One Event Calendar Plugin for WordPress: CVE-2012-1835 1.1...

XSS vulnerability in CMS Tree Page View Wordpress Plugin

High-Tech Bridge SA Security Research Lab has discovered vulnerability in CMS Tree Page View Wordpress Plugin, which can be exploited to perform Cross-Site Scripting XSS attacks. 1 Cross-Site Scripting XSS in CMS Tree Page View Wordpress Plugin: CVE-2012-1834 1.1 Input passed via the "cmstpvview"...

Multiple vulnerabilities in osCmax

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in osCmax, which can be exploited to perform SQL Injection and Cross-Site Scripting XSS attacks. 1 Multiple Cross-Site Scripting XSS in osCmax: CVE-2012-1664 1.1 Input passed via the "username" POST parameter to...

Multiple vulnerabilities in OrangeHRM

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in OrangeHRM, which can be exploited to perform SQL Injection and Cross-Site Scripting XSS attacks. 1 SQL Injection in OrangeHRM: CVE-2012-1506 1.1 Input passed via the "hspSummaryId" GET parameter to...

Multiple vulnerabilities in ocPortal

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in ocPortal, which can be exploited to perform Cross-Site Scripting XSS and Arbitrary File Disclosure attacks. 1 Multiple Cross-Site Scripting XSS in ocPortal: CVE-2012-1470 1.1 Input passed via the "path" and "line...

Multiple vulnerabilities in Open Journal Systems (OJS)

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Open Journal Systems which can be exploited to manipulate local files, upload arbitrary files and perform Cross-Site Scripting XSS attacks. 1 Arbitrary File Manipulation in Open Journal Systems: CVE-2012-1467 1.1...

Multiple vulnerabilities in Elefant CMS

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Elefant CMS, which can be exploited to perform SQL Injection and Cross-Site Scripting XSS attacks. 1 Cross-Site Scripting XSS in Elefant CMS: CVE-2012-1296 1.1 Input passed via the "title" and "body" GET paramete...

Multiple XSS in Fork CMS

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Fork CMS, which can be exploited to perform Cross-Site Scripting XSS attacks. 1 Cross-Site Scripting XSS in Fork CMS: CVE-2012-1188 1.1 Input passed via the "type" and "querystring" GET parameters to...

Multiple XSS in Dotclear

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Dotclear, which can be exploited to perform Cross-Site Scripting XSS attacks. 1 Cross-Site Scripting XSS in Dotclear: CVE-2012-1039 1.1 Input passed via the "logindata" POST parameter to /admin/auth.php is not...

Multiple XSS in Chyrp

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Chyrp, which can be exploited to perform Cross Site Scripting attacks. 1 Cross Site Scripting XSS in Chyrp: CVE-2012-1001 1.1 Input passed via the "content" POST parameter to /includes/ajax.php is not properly...

Multiple vulnerabilities in LEPTON

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in LEPTON, which can be exploited to perform Local File Inclusion, Cross Site Scripting and SQL Injection attacks. 1 Local File Inclusion in LEPTON: CVE-2012-0998 Input passed via the "language" POST parameter to...

Multiple vulnerabilities in 11in1

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in 11in1, which can be exploited to perform Local File Inclusion and Сross-Site Request Forgery CSRF attacks. 1 Local File Inclusion in 11in1: CVE-2012-0996 Input passed via the "class" GET parameter to index.php an...

Multiple vulnerabilities in ZENphoto

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in ZENphoto, which can be exploited to perform arbitrary PHP code execution, sql injection and cross site scripting attacks. 1 Arbitrary PHP Code Execution in ZENphoto: CVE-2012-0993 Input passed via...

Multiple vulnerabilities in OpenEMR

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in OpenEMR, which can be exploited to perform local file inclusion and arbitrary command execution attacks. 1 Multiple Local File Inclusion vulnerabilities in OpenEMR: CVE-2012-0991 1.1 Input passed via the "formnam...

CSRF (Cross-Site Request Forgery) in DClassifieds

High-Tech Bridge SA Security Research Lab has discovered vulnerability in DClassifieds, which can be exploited to perform Сross-Site Request Forgery CSRF attacks. 1 Cross-site request forgery CSRF in DClassifieds: CVE-2012-0990 The application allows authorized users to perform certain actions vi...

Multiple vulnerabilities in OSclass

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in OSclass, which can be exploited to perform cross-site scripting and sql injection attacks. 1 SQL Injection in OSclass: CVE-2012-0973. Input passed via the "sCategory" GET parameter to /index.php is not properly...

XSS in OneOrZero AIMS

High-Tech Bridge SA Security Research Lab has discovered vulnerability in OneOrZero AIMS, which can be exploited to perform cross-site scripting attacks. 1 Cross-site scripting XSS vulnerability in OneOrZero AIMS: CVE-2012-0989 Input appended to the URL after index.php is not properly sanitised...

Multiple XSS in KnowledgeTree Community Edition

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in KnowledgeTree Community Edition, which can be exploited to perform cross-site scripting attacks. 1 Cross-site scripting XSS vulnerabilities in KnowledgeTree Community Edition: CVE-2012-0988 Input appended to the...

Multiple vulnerabilities in ImpressCMS

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in ImpressCMS, which can be exploited to perform cross-site scripting and local file inclusion attacks. 1 Multiple Arbitrary XSS vulnerabilities in ImpressCMS: CVE-2012-0986 1.1 Input appended to the URL after...

2 Buffer Overflows in Wireless Manager Sony VAIO

High-Tech Bridge SA Security Research Lab has discovered 2 buffer overflow vulnerabilities in Wireless Manager Sony VAIO which can be exploited to execute arbitrary code on vulnerable system. 1 Buffer Overflow in Wireless Manager Sony VAIO: CVE-2012-0985 1.1 The method SetTmpProfileOption in...

Multiple XSS vulnerabilities in XOOPS

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in XOOPS, which can be exploited to perform Cross-Site Scripting XSS attacks. 1 Multiple Cross-Site Scripting XSS in XOOPS: CVE-2012-0984 1.1 Input passed via the "touserid" POST parameter to /modules/pm/pmlite.php ...

Cross-site Scripting (XSS) Vulnerabilities in epesi BIM

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in epesi BIM which could be exploited to perform cross-site scripting attacks. 1 Cross-site scripting XSS vulnerabilities in epesi BIM 1.1 The vulnerability exists due to input sanitation error in the "diratual"...

Multiple vulnerabilities in OBM

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in OBM, which can be exploited to perform cross-site scripting, local file inclusion and SQL injection attacks and gain access to sensitive information. 1 Local File Inclusion in OBM 1.1 Input passed via the "module...

Multiple vulnerabilities in PHPShop CMS Free

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in PHPShop CMS Free, which can be exploited to perform cross-site scripting and SQL injection attacks. 1 Cross-Site Scripting in PHPShop CMS Free 1.1 Input appended to the URL after multiple files is not properly...

Multiple vulnerabilities in Browser CRM

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Browser CRM, which can be exploited to perform cross-site scripting and SQL injection attacks. 1 Cross-Site Scripting in Browser CRM 1.1 Input appended to the URL after multiple files is not properly sanitised...

Multiple Vulnerabilities in OrangeHRM

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in OrangeHRM, which can be exploited to perform Cross-Site Scripting XSS and SQL Injection attacks. 1 Cross-Site Scripting XSS vulnerabilities in OrangeHRM 1.1 Input passed via the "uniqcode" GET parameter to...

Multiple vulnerabilities in Dolibarr

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Dolibarr, which can be exploited to perform cross-site scripting & sql injection attacks. 1 Cross-Site scripting vulnerability in Dolibarr: CVE-2011-4814 1.1 Input appended to the URL after multiple files is not...

Multiple Vulnerabilities in webERP

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in webERP, which can be exploited to perform information disclosure, cross-site scripting and SQL injection attacks. 1 Cross-Site Scripting XSS vulnerabilities in webERP Input appended to the URL in multiple files i...

Local File Inclusion Vulnerabilities in vtiger CRM

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in vtiger CRM which could be exploited to perform gain access to sensitive information and compromise vulnerable system. 1 Local file inclusion vulnerabilities in vtiger CRM 1.1 The vulnerability exists due to input...

Multiple vulnerabilities in Efront

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Efront, which can be exploited to perform SQL injection and cross-site scripting attacks. 1 Cross-Site scripting XSS vulnerabilities in Efront 1.1 Input passed via the "course" GET parameter to index.php is not...

SQL Injection in SugarCRM

High-Tech Bridge SA Security Research Lab has discovered vulnerability in SugarCRM, which can be exploited to perform SQL injection attacks. 1 SQL Injection Vulnerability in SugarCRM: CVE-2011-4833 Input passed via the "where" and "order" GET parameters to index.php is not properly sanitised befo...

Installation Path Disclosure Weakness in SPIP

High-Tech Bridge SA Security Research Lab has discovered a weakness in SPIP which could be exploited to gain access to potentially sensitive information. 1 Installation path disclosure weakness in SPIP The weakness exists due to application reveals the full path to installation directory in an...

Multiple vulnerabilities in Tine 2.0

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Tine 2.0, which can be exploited to perform cross-site scripting attacks. 1 Cross-site scripting XSS vulnerabilities in Tine 2.0 1.1 Input passed via the "lang" GET parameter to /library/idnaconvert/example.php i...

Multiple vulnerabilities in BugFree

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in BugFree which can be exploited to perform cross-site scripting attacks. 1 Cross-site scripting XSS vulnerabilities in BugFree 1.1 Input passed via the "ActionType" GET parameter to Bug.php is not properly sanitis...

Cross-site Scripting Vulnerabilities in Pretty Link WordPress Plugin

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Pretty Link WordPress Plugin which could be exploited to perform cross-site scripting attacks. 1 Cross-site scripting XSS vulnerabilities in Pretty Link WordPress Plugin 1.1 Input passed via the "mindate" GET...

Multiple Vulnerabilities in Traq

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Traq which could be exploited to perform cross-site scripting and SQL injection attacks. 1 Cross-site scripting XSS vulnerabilities in Traq 1.1 The vulnerability exists due to input sanitation error in the "edit"...