Show filters
65 Total Results
Displaying 11-20 of 65
Sort by:
Attacker Value
Unknown
CVE-2011-4565
Disclosure Date: November 28, 2011 (last updated October 04, 2023)
Multiple cross-site scripting (XSS) vulnerabilities in XOOPS 2.5.1.a, and possibly earlier versions, allow remote attackers to inject arbitrary web script or HTML via the (1) text parameter to include/formdhtmltextarea_preview.php or (2) img BBCODE tag within the message parameter to pmlite.php (aka Private Message). NOTE: some of these details are obtained from third party information.
0
Attacker Value
Unknown
CVE-2011-3822
Disclosure Date: September 24, 2011 (last updated October 04, 2023)
XOOPS 2.5.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by modules/system/xoops_version.php and certain other files.
0
Attacker Value
Unknown
CVE-2009-4851
Disclosure Date: May 07, 2010 (last updated October 04, 2023)
The activation resend function in the Profiles module in XOOPS before 2.4.1 sends activation codes in response to arbitrary activation requests, which allows remote attackers to bypass administrative approval via a request involving activate.php.
0
Attacker Value
Unknown
CVE-2009-4698
Disclosure Date: March 15, 2010 (last updated October 04, 2023)
Multiple SQL injection vulnerabilities in the Qas (aka Quas) module for XOOPS Celepar allow remote attackers to execute arbitrary SQL commands via the codigo parameter to (1) aviso.php and (2) imprimir.php, and the (3) cod_categoria parameter to categoria.php.
0
Attacker Value
Unknown
CVE-2009-4714
Disclosure Date: March 15, 2010 (last updated October 04, 2023)
Cross-site scripting (XSS) vulnerability in the quiz module for XOOPS Celepar allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to cadastro_usuario.php.
0
Attacker Value
Unknown
CVE-2009-4713
Disclosure Date: March 15, 2010 (last updated October 04, 2023)
Multiple cross-site scripting (XSS) vulnerabilities in the Qas (aka Quas) module for XOOPS Celepar allow remote attackers to inject arbitrary web script or HTML via (1) the cod_categoria parameter to categoria.php, (2) the opcao parameter to index.php, and the PATH_INFO to (3) categoria.php and (4) index.php.
0
Attacker Value
Unknown
CVE-2009-4582
Disclosure Date: January 06, 2010 (last updated October 04, 2023)
SQL injection vulnerability in detail.php in the Dictionary module for XOOPS 2.0.18 allows remote attackers to execute arbitrary SQL commands via the id parameter.
0
Attacker Value
Unknown
CVE-2009-3963
Disclosure Date: November 17, 2009 (last updated October 04, 2023)
Multiple unspecified vulnerabilities in XOOPS before 2.4.0 Final have unknown impact and attack vectors.
0
Attacker Value
Unknown
CVE-2008-7036
Disclosure Date: August 24, 2009 (last updated October 04, 2023)
Multiple cross-site scripting (XSS) vulnerabilities in index.php in DevTracker module 3.0 for bcoos 1.1.11 and earlier, and DevTracker module 0.20 for E-XooPS 1.0.8 and earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) direction and (2) order_by parameters.
0
Attacker Value
Unknown
CVE-2009-2783
Disclosure Date: August 17, 2009 (last updated October 04, 2023)
Multiple cross-site scripting (XSS) vulnerabilities in XOOPS 2.3.3 allow remote attackers to inject arbitrary web script or HTML via the (1) op parameter to modules/pm/viewpmsg.php and (2) query string to modules/profile/user.php.
0
