Recent Curesec Publications

2015 Dec 21

Arastta 1.1.5: XSS

There is a reflected XSS vulnerability in Arastta 1.1.5.  

2015 Dec 21

Arastta 1.1.5: SQL Injection

There are two SQL Injections in Arastta 1.1.5, which both require a user with special privileges to trigger.  

2015 Dec 21

Grawlix 1.0.3: XSS

Grawlix 1.0.3 has multiple reflected XSS vulnerabilities.  

2015 Dec 21

Grawlix 1.0.3: CSRF

Grawlix 1.0.3 does not have CSRF protection, allowing an attacker to execute actions for a victim - for example changing the password of an admin user.  

2015 Dec 21

Grawlix 1.0.3: Code Execution

Grawlix 1.0.3 does not check the file type or extension when an admin uploads an icon, leading to code execution.  

2015 Dec 21

CouchCMS 1.4.5: XSS & Open Redirect

There are two reflected XSS and one open redirect vulnerability in CouchCMS 1.4.5.  

2015 Dec 21

CouchCMS 1.4.5: Code Execution

The file extension whitelist of CouchCMS 1.4.5 misses pht, which may lead to code execution under certain circumstances.  

2015 Dec 21

esoTalk 1.0.0g4: XSS

There is a reflected XSS vulnerability in the search of esoTalk 1.0.0g4.  

2015 Dec 02

4images 1.7.12: XSS

There are multiple XSS vulnerabilities in 4images 1.7.12.  

2015 Dec 02

4images 1.7.11: SQL Injection

There is an SQL Injection vulnerability in the admin area of 4images 1.7.11.