13 results (0.001 seconds)

CVSS: 3.5EPSS: 0%CPEs: 1EXPL: 2

CVE-2011-3978

https://notcve.org/view.php?id=CVE-2011-3978

Multiple cross-site scripting (XSS) vulnerabilities in LightNEasy.php in LightNEasy 3.2.4 allow remote authenticated users to inject arbitrary web script or HTML via the (1) commentemail, (2) commentmessage, or (3) commentname parameter in a sendcomment action for the news page. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en LightNEasy.php en LightNEasy v3.2.4, permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML a través de los parámetros (1) commentemail, (2) commentmessage, o (3) commentname en una acción sendcomment sobre una página de noticias. • http://osvdb.org/75262 http://secunia.com/advisories/45955 http://securityreason.com/securityalert/8407 http://www.lightneasy.org/punbb/viewtopic.php?id=1464 http://www.rul3z.de/advisories/SSCHADV2011-013.txt http://www.securityfocus.com/archive/1/519571/100/0/threaded https://exchange.xforce.ibmcloud.com/vulnerabilities/69737 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 1

CVE-2010-4752 – LightNEasy CMS 3.2.1 - Blind SQL Injection

https://notcve.org/view.php?id=CVE-2010-4752

SQL injection vulnerability in LightNEasy.php in LightNEasy 3.2.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the page parameter, a different vector than CVE-2008-6593, CVE-2010-3484, and CVE-2010-3485. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Vulnerabilidad de inyección SQL en LightNEasy.php de LightNEasy 3.2.1, si magic_quotes_gpc está deshabilitado, permite a atacantes remotos ejecutar comandos SQL de su elección a través del parámetro page. Un vector distinto al de CVE-2008-6593, CVE-2010-3484 y CVE-2010-3485. NOTA: la procedencia de esta información es desconocida; los detalles han sido obtenidos únicamente de información de terceras partes. • https://www.exploit-db.com/exploits/15060 http://secunia.com/advisories/42391 http://www.lightneasy.org/punbb/viewtopic.php?id=1207 http://www.securityfocus.com/bid/45230 https://exchange.xforce.ibmcloud.com/vulnerabilities/63722 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 6.0EPSS: 0%CPEs: 1EXPL: 1

CVE-2010-4751 – LightNEasy CMS 3.2.1 - Blind SQL Injection

https://notcve.org/view.php?id=CVE-2010-4751

SQL injection vulnerability in LightNEasy.php in LightNEasy 3.2.1, when magic_quotes_gpc is disabled, allows remote authenticated users to execute arbitrary SQL commands via the id parameter in an edituser action, a different vector than CVE-2008-6593, CVE-2010-3484, and CVE-2010-3485. Vulnerabilidad de inyección SQL en LightNEasy.php de LightNEasy 3.2.1, si magic_quotes_gpc está deshabilitado, permite a usuarios remotos autenticados ejecutar comandos SQL de su elección a través del parámetro id de una acción edituser. Un vector diferente al de CVE-2008-6593, CVE-2010-3484 y CVE-2010-3485. • https://www.exploit-db.com/exploits/15060 http://holisticinfosec.org/content/view/168/45 http://secunia.com/advisories/42391 http://www.lightneasy.org/punbb/viewtopic.php?id=1207 http://www.securityfocus.com/bid/45230 https://exchange.xforce.ibmcloud.com/vulnerabilities/63723 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0

CVE-2010-4753

https://notcve.org/view.php?id=CVE-2010-4753

Cross-site scripting (XSS) vulnerability in LightNEasy.php in LightNEasy 3.2.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter, which is not properly handled in a forced SQL error message. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en LightNEasy.php de LightNEasy 3.2.1. Permite a atacantes remotos inyectar codigo de script web o código HTML de su elección a través del parámetro id, que no es manejado apropiadamente en un mensaje de error SQL forzado. • http://holisticinfosec.org/content/view/168/45 http://secunia.com/advisories/42391 http://www.lightneasy.org/punbb/viewtopic.php?id=1207 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 4

CVE-2010-3484 – LightNEasy CMS 3.2.1 - Blind SQL Injection

https://notcve.org/view.php?id=CVE-2010-3484

SQL injection vulnerability in common.php in LightNEasy 3.2.1 allows remote attackers to execute arbitrary SQL commands via the handle parameter to LightNEasy.php, a different vector than CVE-2008-6593. Vulnerabilidad de inyección SQL en common.php en LightNEasy en v3.2.1 permite a atacantes remotos ejecutar comandos SQL de su elección a mediante la manipulación de un parámetro en LightNEasy.php, un vector diferente de CVE-2008-6593. • https://www.exploit-db.com/exploits/15060 http://packetstormsecurity.org/1009-exploits/lightneasy-sql.txt http://secunia.com/advisories/41502 http://www.exploit-db.com/exploits/15060 http://www.securityfocus.com/bid/43330 http://www.vupen.com/english/advisories/2010/2457 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •