CVE-2012-4278

CVE-2012-4278 describes multiple cross-site scripting (XSS) vulnerabilities in Free Realty 3.1-0.6. The issues allow remote attackers to inject arbitrary scripts via: (1) the notes parameter to admin/agenteditor.php; (2) the title, (3) previewdesc, (4) fulldesc, or (5) notes parameter to agentadm...

CVE-2012-4279

Free Realty 3.1-0.6 contains SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands via the view parameter in agentdisplay.php or the edit parameter in admin/admin.php. The issue is described across multiple sources as consistent with unparameterized input lea...

CVE-2012-4280

CVE-2012-4280 affects Free Realty 3.1-0.6, with multiple CSRF weaknesses in admin/agenteditor.php. The flaws allow remote attackers to hijack administrator sessions by issuing requests to add an agent (addagent action) or modify an existing agent, compromising authentication integrity. Exploitati...