osclass/Osclass

osclass/Osclass

Releases51

Frequency1 month 2 weeks

Last Release almost 9 years ago

Stars653

With Osclass, get your own classifieds site for free. Build your own Osclass installation and start advertising real estate, jobs or whatever you want- in minutes!

Log in to subscribe

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2014-6280 ↗	Oct 20, 2014Monday, 20 October 2014, 14:55	—	4.3 MEDIUM
Multiple cross-site scripting (XSS) vulnerabilities in OSClass before 3.4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) action or (2) nsextt parameter to oc-admin/index.php or the (3) nsextt parameter in an items_reported action to oc-admin/index.php.
CVE-2014-6308 ↗	Oct 20, 2014Monday, 20 October 2014, 14:55	—	5 MEDIUM
Directory traversal vulnerability in OSClass before 3.4.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter in a render action to oc-admin/index.php.
CVE-2012-1617 ↗	Sep 26, 2012Wednesday, 26 September 2012, 00:55	—	6.4 MEDIUM
Directory traversal vulnerability in combine.php in OSClass before 2.3.6 allows remote attackers to read and write arbitrary files via a .. (dot dot) in the type parameter. NOTE: this vulnerability can be leveraged to upload arbitrary files.
CVE-2012-5162 ↗	Sep 26, 2012Wednesday, 26 September 2012, 00:55	—	6.5 MEDIUM
Multiple SQL injection vulnerabilities in oc-admin/ajax/ajax.php in OSClass before 2.3.5 allow remote attackers to execute arbitrary SQL commands via the id parameter in a (1) edit_category_post or (2) enable_category action to index.php.
CVE-2012-5163 ↗	Sep 26, 2012Wednesday, 26 September 2012, 00:55	—	4.3 MEDIUM
Cross-site scripting (XSS) vulnerability in oc-admin/ajax/ajax.php in OSClass before 2.3.5 allows remote attackers to inject arbitrary web script or HTML via the id parameter in an enable_category action to index.php.
CVE-2012-0973 ↗	Sep 25, 2012Tuesday, 25 September 2012, 23:55	—	7.5 HIGH
Multiple SQL injection vulnerabilities in OSClass before 2.3.5 allow remote attackers to execute arbitrary SQL commands via the sCategory parameter to index.php, which is not properly handled by the (1) osc_search_category_id function in oc-includes/osclass/helpers/hSearch.php and (2) findBySlug function oc-includes/osclass/model/Category.php. NOTE: some of these details are obtained from third party information.
CVE-2012-0974 ↗	Sep 25, 2012Tuesday, 25 September 2012, 23:55	—	4.3 MEDIUM
Multiple cross-site scripting (XSS) vulnerabilities in the getParam function in oc-includes/osclass/core/Params.php in OSClass before 2.3.5 allow remote attackers to inject arbitrary web script or HTML via the (1) sCity, (2) sPattern, (3) sPriceMax, and (4) sPriceMin parameters in a search action to index.php.