deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-2586
Published: 2012-09-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in Mailtraq 2.17.3.3150 allow remote attackers to inject arbitrary web script or HTML via an e-mail message subject with (1) a JavaScript alert function used in conjunction with the fromCharCode method or (2) a SCRIPT element; an e-mail message body with (3) a crafted SRC attribute of an IFRAME element, (4) a data: URL in the CONTENT attribute of an HTTP-EQUIV="refresh" META element, or (5) a Cascading Style Sheets (CSS) expression property in the STYLE attribute of an IMG element; or an e-mail message Date header with (6) a JavaScript alert function used in conjunction with the fromCharCode method, (7) a SCRIPT element, (8) a CSS expression property in the STYLE attribute of an arbitrary element, (9) a crafted SRC attribute of an IFRAME element, or (10) a data: URL in the CONTENT attribute of an HTTP-EQUIV="refresh" META element.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.exploit-db.com/exploits/20353/; http://www.exploit-db.com/exploits/20353/
CVE: CVE-2012-4400
Published: 2012-09-19
Description: repository/repository_ajax.php in Moodle 2.2.x before 2.2.5 and 2.3.x before 2.3.2 allows remote authenticated users to bypass intended upload-size restrictions via a -1 value in the maxbytes field.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-30792; http://moodle.org/mod/forum/discuss.php?d=211555; http://openwall.com/lists/oss-security/2012/09/17/1
CVE: CVE-2012-4401
Published: 2012-09-19
Description: Moodle 2.2.x before 2.2.5 and 2.3.x before 2.3.2 allows remote authenticated users to bypass intended capability restrictions and perform certain topic changes by leveraging course-editing capabilities.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-28207; http://moodle.org/mod/forum/discuss.php?d=211556; http://openwall.com/lists/oss-security/2012/09/17/1
CVE: CVE-2012-4402
Published: 2012-09-19
Description: webservice/lib.php in Moodle 2.1.x before 2.1.8, 2.2.x before 2.2.5, and 2.3.x before 2.3.2 does not properly restrict the use of web-service tokens, which allows remote authenticated users to run arbitrary external-service functions via a token intended for only one service.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-34368; http://moodle.org/mod/forum/discuss.php?d=211559; http://openwall.com/lists/oss-security/2012/09/17/1
CVE: CVE-2012-4403
Published: 2012-09-19
Description: theme/yui_combo.php in Moodle 2.3.x before 2.3.2 does not properly construct error responses for the drag-and-drop script, which allows remote attackers to obtain the installation path by sending a request for a nonexistent resource and then reading the response.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-35168; http://moodle.org/mod/forum/discuss.php?d=211560; http://openwall.com/lists/oss-security/2012/09/17/1
CVE: CVE-2012-4407
Published: 2012-09-19
Description: lib/filelib.php in Moodle 2.1.x before 2.1.8, 2.2.x before 2.2.5, and 2.3.x before 2.3.2 does not properly check the publication state of blog files, which allows remote attackers to obtain sensitive information by reading a blog entry that references a non-public file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-34585; http://moodle.org/mod/forum/discuss.php?d=211557; http://openwall.com/lists/oss-security/2012/09/17/1
CVE: CVE-2012-4408
Published: 2012-09-19
Description: course/reset.php in Moodle 2.1.x before 2.1.8, 2.2.x before 2.2.5, and 2.3.x before 2.3.2 checks an update capability instead of a reset capability, which allows remote authenticated users to bypass intended access restrictions via a reset operation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-34519; http://moodle.org/mod/forum/discuss.php?d=211558; http://openwall.com/lists/oss-security/2012/09/17/1
CVE: CVE-2012-1651
Published: 2012-09-19
Description: Cross-site scripting (XSS) vulnerability in the Submenu Tree module before 6.x-1.5 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1132838; http://drupal.org/node/1461470; http://secunia.com/advisories/48202
CVE: CVE-2012-1652
Published: 2012-09-19
Description: Cross-site scripting (XSS) vulnerability in the Hierarchical Select module 6.x-3.x before 6.x-3.8 for Drupal allows remote authenticated users with administer taxonomy permissions to inject arbitrary web script or HTML via unspecified vectors related to "the vocabulary's help text."
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1461318; http://drupal.org/node/1461724; http://drupalcode.org/project/hierarchical_select.git/commit/be32dceb17d25553e474c295a8c3db69eab95cee
CVE: CVE-2012-1653
Published: 2012-09-19
Description: Cross-site scripting (XSS) vulnerability in the Taxonomy Views Integrator (TVI) module 6.x-1.x before 6.x-1.3 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, related to "views pages."
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1306946; http://drupal.org/node/1461892; http://osvdb.org/79682
CVE: CVE-2012-2105
Published: 2012-09-19
Description: Multiple SQL injection vulnerabilities in login.php in Timesheet Next Gen 1.5.2 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2012-03/0011.html; http://secunia.com/advisories/48239; http://sourceforge.net/apps/mantisbt/tsheetx/view.php?id=122
CVE: CVE-2012-2991
Published: 2012-09-19
Description: The PayPal (aka MODULE_PAYMENT_PAYPAL_STANDARD) module before 1.1 in osCommerce Online Merchant before 2.3.4 allows remote attackers to set the payment recipient via a modified value of the merchant's e-mail address, as demonstrated by setting the recipient to one's self.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/50640; http://www.kb.cert.org/vuls/id/459446; http://secunia.com/advisories/50640
CVE: CVE-2012-3373
Published: 2012-09-19
Description: Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.21 and 1.5.x before 1.5.8 allows remote attackers to inject arbitrary web script or HTML via vectors involving a %00 sequence in an Ajax link URL associated with a Wicket app.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/85249; http://secunia.com/advisories/50555; http://wicket.apache.org/2012/09/06/cve-2012-3373.html
CVE: CVE-2012-4992
Published: 2012-09-19
Description: Multiple buffer overflows in FlashFXP.exe in FlashFXP 4.2 allow remote authenticated users to execute arbitrary code via a long unicode string to (1) TListbox or (2) TComboBox.
CVSS Score: 9.0 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2012-03/0002.html; http://osvdb.org/79767; http://seclists.org/fulldisclosure/2012/Mar/7
CVE: CVE-2012-4993
Published: 2012-09-19
Description: torrent_functions.php in RivetTracker 1.03 and earlier does not properly restrict access, which allows remote attackers to have an unspecified impact.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://www.exploit-db.com/exploits/18553; http://www.exploit-db.com/exploits/18553
CVE: CVE-2012-4994
Published: 2012-09-19
Description: SQL injection vulnerability in admin/admin.php in LimeSurvey before 1.91+ Build 120224 allows remote authenticated users to execute arbitrary SQL commands via the id parameter in a browse action.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://freecode.com/projects/limesurvey/releases/342070; http://osvdb.org/79688; http://secunia.com/advisories/48184
CVE: CVE-2012-4995
Published: 2012-09-19
Description: Cross-site scripting (XSS) vulnerability in admin/userrighthandling.php in LimeSurvey before 1.91+ Build 120224 allows remote attackers to inject arbitrary web script or HTML via the full_name parameter in a moduser action to admin/admin.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://freecode.com/projects/limesurvey/releases/342070; http://osvdb.org/79687; http://secunia.com/advisories/48184
CVE: CVE-2012-4996
Published: 2012-09-19
Description: Multiple SQL injection vulnerabilities in RivetTracker 1.03 and earlier allow remote attackers to execute arbitrary SQL commands via the hash parameter to (1) dltorrent.php or (2) torrent_functions.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/48245; http://www.exploit-db.com/exploits/18553; http://www.osvdb.org/79805
CVE: CVE-2012-4997
Published: 2012-09-19
Description: Directory traversal vulnerability in acp/index.php in AneCMS allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the p parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.exploit-db.com/exploits/18559; http://www.securityfocus.com/bid/52272; https://exchange.xforce.ibmcloud.com/vulnerabilities/73682
CVE: CVE-2012-4998
Published: 2012-09-19
Description: Cross-site scripting (XSS) vulnerability in index.php in starCMS allows remote attackers to inject arbitrary web script or HTML via the q parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/79739; http://packetstormsecurity.org/files/110376/starcms-xss.txt; http://www.securityfocus.com/bid/52262
CVE: CVE-2012-4999
Published: 2012-09-19
Description: Mercury MR804 Router 8.0 3.8.1 Build 101220 Rel.53006nB allows remote attackers to cause a denial of service (service hang) via a crafted string in HTTP header fields such as (1) If-Modified-Since, (2) If-None-Match, or (3) If-Unmodified-Since.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2012-02/0116.html; http://secunia.com/advisories/48079; http://www.securityfocus.com/bid/52106
CVE: CVE-2012-5000
Published: 2012-09-19
Description: SQL injection vulnerability in jokes/index.php in the Witze addon 0.9 for deV!L'z Clanportal allows remote attackers to execute arbitrary SQL commands via the id parameter in a show action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/48233; http://www.exploit-db.com/exploits/18558; http://www.osvdb.org/79807
CVE: CVE-2012-5001
Published: 2012-09-19
Description: Multiple unspecified vulnerabilities in Hitachi JP1/Cm2/Network Node Manager i before 09-50-03 allow remote attackers to cause a denial of service and possibly execute arbitrary code via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/79685; http://osvdb.org/79686; http://secunia.com/advisories/48201
CVE: CVE-2012-5002
Published: 2012-09-19
Description: Stack-based buffer overflow in SR10 FTP server (SR10.exe) 1.1.0.6 in Ricoh DC Software DL-10 4.5.0.1, when the Log file name option is enabled, allows remote attackers to execute arbitrary code via a long USER FTP command.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/47912; http://security.inshell.net/advisory/5; http://www.osvdb.org/79691
CVE: CVE-2012-1638
Published: 2012-09-19
Description: SQL injection vulnerability in the Search Autocomplete module before 7.x-2.1 for Drupal allows remote authenticated users with the "use search_autocomplete" permission to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-89
References: http://drupal.org/node/1410674; http://drupal.org/node/1416612; http://drupalcode.org/project/search_autocomplete.git/commit/589e8f6
CVE: CVE-2012-1640
Published: 2012-09-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Managesite module 6.x-1.x before 6.1-1.1 for Drupal allow remote authenticated users with "administer managesite" permissions to inject arbitrary web script or HTML via the title parameter when (1) adding or (2) updating a category.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1417000; http://drupalcode.org/project/managesite.git/blobdiff/7dd99c47d891d482be1430d3c06a5bb0f6c74d85..7051b7e:/managesite.module; http://secunia.com/advisories/47732
CVE: CVE-2012-5003
Published: 2012-09-19
Description: nxapplet.jar in No Machine NX Web Companion 3.x and earlier does not properly verify the authenticity of updates, which allows user-assisted remote attackers to execute arbitrary code via a crafted (1) SiteUrl or (2) RedirectUrl parameter that points to a Trojan Horse client.zip update file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://archives.neohapsis.com/archives/bugtraq/2012-01/0161.html; http://archives.neohapsis.com/archives/fulldisclosure/2012-01/0466.html; http://secunia.com/advisories/47685
CVE: CVE-2012-5004
Published: 2012-09-19
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Parallels H-Sphere 3.3 Patch 1 allow remote attackers to hijack the authentication of admins for requests that (1) add group plans via admin/group_plans.html or (2) add extra packages via admin/extra_packs/create_extra_pack.html.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/78505; http://packetstormsecurity.org/files/view/108972/VL-392.txt; http://secunia.com/advisories/47556
CVE: CVE-2012-5005
Published: 2012-09-19
Description: Cross-site request forgery (CSRF) vulnerability in admin/admin_options.php in VR GPub 4.0 allows remote attackers to hijack the authentication of admins for requests that add admin accounts via an add action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/47729; http://www.exploit-db.com/exploits/18418; https://exchange.xforce.ibmcloud.com/vulnerabilities/72745
CVE: CVE-2012-5006
Published: 2012-09-19
Description: Heap-based buffer overflow in npdjvu.dll in Caminova DjVu Browser Plug-in 6.1.4 Build 27351 and other versions before 6.1.4.27993 allows remote attackers to execute arbitrary code via a crafted Sjbz chunk in a djvu file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/46091; http://www.caminova.com/en/downloads/download.aspx?id=1; http://www.osvdb.org/78526
CVE: CVE-2012-0988
Published: 2012-09-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in config/dmsDefaults.php in KnowledgeTree 3.7.0.2 and possibly earlier allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) login.php, (2) admin.php, or (3) preferences.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-01/0070.html; http://secunia.com/advisories/47531; http://www.knowledgetree.org/Security_advisory:_URL_Manipulation
CVE: CVE-2012-1627
Published: 2012-09-20
Description: Cross-site scripting (XSS) vulnerability in vud_term.module in the Vote Up/Down module 6.x-2.x before 6.x-2.8 and 6.x-3.x before 6.x-3.1 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via taxonomy terms.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1400528; http://drupal.org/node/1400530; http://drupal.org/node/1401580
CVE: CVE-2012-1632
Published: 2012-09-20
Description: Cross-site scripting (XSS) vulnerability in password_policy.admin.inc in the Password Policy module before 6.x-1.4 and 7.x-1.0 beta3 for Drupal allows remote authenticated users with administer policies permissions to inject arbitrary web script or HTML via the name parameter.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1401678; http://drupalcode.org/project/password_policy.git/commit/3c688c3b4a3ed96fdc4b[PII_REDACTED]3338c7ebb6; http://secunia.com/advisories/47541
CVE: CVE-2012-1633
Published: 2012-09-20
Description: Cross-site request forgery (CSRF) vulnerability in the Password Policy module before 6.x-1.4 and 7.x-1.0 beta3 for Drupal allows remote attackers to hijack the authentication of administrative users for requests that unblock a user.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://drupal.org/node/1401678; http://drupalcode.org/project/password_policy.git/commit/3c688c3b4a3ed96fdc4b[PII_REDACTED]3338c7ebb6; http://secunia.com/advisories/47541
CVE: CVE-2012-1625
Published: 2012-09-20
Description: Eval injection vulnerability in the fillpdf_form_export_decode function in fillpdf.admin.inc in the Fill PDF module 6.x-1.x before 6.x-1.16 and 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with administer PDFs privileges to execute arbitrary PHP code via unspecified vectors.  NOTE: Some of these details are obtained from third party information.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-94
References: http://drupal.org/node/1394428; http://osvdb.org/78182; http://secunia.com/advisories/47418
CVE: CVE-2012-1626
Published: 2012-09-20
Description: SQL injection vulnerability in the conversion form for Events in the Date module 6.x-2.x before 6.x-2.8 for Drupal allows remote authenticated users with the "administer Date Tools" privilege to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-89
References: http://drupal.org/node/1401026; http://drupal.org/node/1401434; http://osvdb.org/78261
CVE: CVE-2012-1628
Published: 2012-09-20
Description: Cross-site scripting (XSS) vulnerability in the SuperCron module for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1401644; http://www.openwall.com/lists/oss-security/2012/04/07/1; https://exchange.xforce.ibmcloud.com/vulnerabilities/72389
CVE: CVE-2012-1629
Published: 2012-09-20
Description: Cross-site scripting (XSS) vulnerability in the Taxotouch module for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1401644; http://www.openwall.com/lists/oss-security/2012/04/07/1; http://www.securityfocus.com/bid/51387
CVE: CVE-2012-1630
Published: 2012-09-20
Description: Cross-site scripting (XSS) vulnerability in the Taxonomy Navigator module for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1401644; http://www.openwall.com/lists/oss-security/2012/04/07/1; http://www.securityfocus.com/bid/51387
CVE: CVE-2012-1631
Published: 2012-09-20
Description: Cross-site request forgery (CSRF) vulnerability in the Admin:hover module for Drupal allows remote attackers to hijack the authentication of administrators for requests that unpublish all nodes, and possibly other actions, via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://drupal.org/node/1401644; http://drupal.org/node/1407206; http://www.openwall.com/lists/oss-security/2012/04/07/1
CVE: CVE-2012-5007
Published: 2012-09-20
Description: The Fill PDF module 7.x-1.x before 7.x-1.2 for Drupal allows remote attackers to write to arbitrary PDF files via unspecified vectors related to the fillpdf_merge_pdf function and incorrect arguments, a different vulnerability than CVE-2012-1625.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/1394428; http://osvdb.org/78181; http://secunia.com/advisories/47418
CVE: CVE-2011-5177
Published: 2012-09-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in admin/controller.php in eSyndiCat Pro 2.3.05 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to the admins (2) blocks, (3) articles, or (4) suggest-category; or (5) sort parameter to the search page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/view/107324/esyndicatpro-xss.txt; http://www.securityfocus.com/bid/50822; https://exchange.xforce.ibmcloud.com/vulnerabilities/71485
CVE: CVE-2011-5178
Published: 2012-09-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in netmri/config/userAdmin/login.tdf in Infoblox NetMRI 6.0.2.42, 6.1.2, 6.2.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) eulaAccepted or (2) mode parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://foregroundsecurity.com/secure-coding-and-security-qa/111-infoblox-netmri-621-612-and-60242-multiple-cross-site-scripting-xss; http://seclists.org/fulldisclosure/2011/Nov/158; http://secunia.com/advisories/46854
CVE: CVE-2011-5179
Published: 2012-09-20
Description: Cross-site scripting (XSS) vulnerability in skysa-official/skysa.php in Skysa App Bar Integration plugin, possibly before 1.04, for WordPress allows remote attackers to inject arbitrary web script or HTML via the submit parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/520662/100/0/threaded; http://www.securityfocus.com/bid/50824; https://exchange.xforce.ibmcloud.com/vulnerabilities/71486
CVE: CVE-2011-5180
Published: 2012-09-20
Description: Cross-site scripting (XSS) vulnerability in wp-1pluginjquery.php in the ZooEffect plugin 1.01 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.  NOTE: some of these details are obtained from third party information. NOTE: this has been disputed by a third party.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.osvdb.org/77648; http://www.securityfocus.com/archive/1/520690/100/0/threaded; http://www.securityfocus.com/bid/50860
CVE: CVE-2011-5181
Published: 2012-09-20
Description: Cross-site scripting (XSS) vulnerability in clickdesk.php in ClickDesk Live Support - Live Chat plugin 2.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cdwidgetid parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/77338; http://wordpress.org/extend/plugins/clickdesk-live-support-chat-plugin/changelog/; http://www.securityfocus.com/archive/1/520624/100/0/threaded
CVE: CVE-2011-5182
Published: 2012-09-20
Description: Cross-site scripting (XSS) vulnerability in lanoba-social-plugin/index.php in the Lanoba Social plugin 1.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter.  NOTE: the vendor disputes this issue, stating "Lanoba's plug in does sanitize user input, and because that input is never sent to the browser, an attacker has no way of executing script or code on a user's behalf.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/520574/100/0/threaded; http://www.securityfocus.com/archive/1/520678/100/0/threaded; http://www.securityfocus.com/bid/50746
CVE: CVE-2011-5183
Published: 2012-09-20
Description: Multiple SQL injection vulnerabilities in OrderSys 1.6.4 and earlier allow remote attackers to execute arbitrary SQL commands via the where_clause parameter to (1) index.php, (2) index_long.php, or (3) index_short.php in ordering/interface_creator/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.bioinformatics.org/phplabware/labwiki/index.php?page=release_notes; http://www.exploit-db.com/exploits/18091; http://www.bioinformatics.org/phplabware/labwiki/index.php?page=release_notes