high-tech bridge sa vulnerabilities and exploits

NA

High-Tech Bridge Security Research Lab discovered vulnerability in ArticleFR, which can be exploited to execute arbitrary UPDATE SQL statements, alter information stored in the database, and gain complete control over the web site....

1 EDB exploit available

7.5

CVSSv2

The Bitrix e-Store module before 14.0.1 for Bitrix Site Manager uses sequential values for the BITRIX_SM_SALE_UID cookie, which makes it easier for remote attackers to guess the cookie value and bypass authentication via a brute force attack....

Bitrix Bitrix E-store Module

4.3

CVSSv2

The eshop_checkout function in checkout.php in the Wordpress Eshop plugin 6.3.11 and earlier does not validate variables in the "eshopcart" HTTP cookie, which allows remote attackers to perform cross-site scripting (XSS) attacks, or a path disclosure attack via crafted...

Eshop Project Eshop

7.5

CVSSv2

Directory traversal vulnerability in update/index.php in PluXml before 5.1.6 allows remote attackers to include and execute arbitrary local files via a ..%2F (encoded dot dot slash) in the default_lang parameter....

Pluxml1 EDB exploit available

NA

pragmaMx version 1.12.1 suffers from a cross site scripting vulnerability....

2 EDB exploits available

7.5

CVSSv2

Multiple SQL injection vulnerabilities in includes/password.php in Redaxscript 0.3.2 allow remote attackers to execute arbitrary SQL commands via the (1) id or (2) password parameter to the password_reset program....

Redaxscript1 EDB exploit available

NA

Hero Framework CVE-2013-2649 Multiple Cross-Site Scripting Vulnerabilities...

2 EDB exploits available

7.5

CVSSv2

Multiple SQL injection vulnerabilities in VastHTML Forum Server (aka ForumPress) plugin 1.6.1 and 1.6.5 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) search_max parameter in a search action to index.php, which is not properly handled by...

Vasthtml Forum Server1 EDB exploit available

4.3

CVSSv2

Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS before 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to backup-edit.php; (2) title or (3) menu parameter to edit.php; or (4) path or (5) returnid parameter to...

Get-simple Getsimple Cms

4.3

CVSSv2

Multiple cross-site scripting (XSS) vulnerabilities in admin.php in Piwigo before 2.3.4 allow remote attackers to inject arbitrary web script or HTML via the (1) section parameter in the configuration module, (2) installstatus parameter in the languages_new module, or (3) theme...

Piwigo1 EDB exploit available

1 2 3 4 5 NEXT »