osclass

Top products

The 10 most recently published vulnerabilities affecting osclass.

• CVE-2016-10751osClass 3.6.1 allows oc-admin/plugins.php Directory Traversal via the plugin parameter. This is exploitable for remote PHP code execution because an administrator can upload an image that contains ...7.2May 24, 2019
• CVE-2018-14481Osclass 3.7.4 has XSS via the query string to index.php, a different vulnerability than CVE-2014-6280.6.1Jan 3, 2019
• CVE-2014-8084Directory traversal vulnerability in oc-includes/osclass/controller/ajax.php in OSClass before 3.4.3 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the a...7.5Jan 5, 2015
• CVE-2014-8083SQL injection vulnerability in the Search::setJsonAlert method in OSClass before 3.4.3 allows remote attackers to execute arbitrary SQL commands via the alert parameter in a search alert subscripti...7.5Jan 5, 2015
• CVE-2014-8085Unrestricted file upload vulnerability in the CWebContact::doModel method in oc-includes/osclass/controller/contact.php in OSClass before 3.4.3 allows remote attackers to execute arbitrary PHP code...6.8Jan 5, 2015
• CVE-2014-6280Multiple cross-site scripting (XSS) vulnerabilities in OSClass before 3.4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) action or (2) nsextt parameter to oc-admin/inde...4.3Oct 20, 2014
• CVE-2014-6308Directory traversal vulnerability in OSClass before 3.4.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter in a render action to oc-admin/index.php.5.0Oct 20, 2014
• CVE-2012-5162Multiple SQL injection vulnerabilities in oc-admin/ajax/ajax.php in OSClass before 2.3.5 allow remote attackers to execute arbitrary SQL commands via the id parameter in a (1) edit_category_post or...6.5Sep 26, 2012
• CVE-2012-5163Cross-site scripting (XSS) vulnerability in oc-admin/ajax/ajax.php in OSClass before 2.3.5 allows remote attackers to inject arbitrary web script or HTML via the id parameter in an enable_category ...4.3Sep 26, 2012
• CVE-2012-0973Multiple SQL injection vulnerabilities in OSClass before 2.3.5 allow remote attackers to execute arbitrary SQL commands via the sCategory parameter to index.php, which is not properly handled by th...7.5Sep 25, 2012