Mambo Open Source < 4.5.2.3 Multiple Vulnerabilities

The installed version of Mambo Open Source on the remote host suffers from the following flaws : - Session ID Spoofing Vulnerability An unspecified flaw in the script 'administrator/index3.php' can be exploited to spoof session IDs. - Local File Disclosure Vulnerability The...

Siteframe siteframe.php LOCAL_PATH Parameter Remote File Inclusion

The remote host is running Siteframe, an open source content management system using PHP and MySQL. The installed version of Siteframe does not properly sanitize the 'LOCALPATH' parameter of the 'siteframe.php' script before using it to include files. By leveraging this flaw, an attacker is able ...

Exhibit Engine list.php Multiple Parameter SQL Injection

The remote host is running Exhibit Engine, a web-based photo gallery written in PHP. The version installed on the remote host suffers from a SQL injection vulnerability due to its failure to sanitize user-supplied input to various parameters of the 'list.php' script. An attacker can exploit these...

WebAPP apage.cgi f Parameter Arbitrary Command Execution

Due to a lack of user input validation, an attacker can exploit the 'apage.cgi' script in the version of WebAPP on the remote host to execute arbitrary commands on the remote host with the privileges of the web server. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Woltlab Burning Board pms.php folderid Parameter XSS

The version of Burning Board or Burning Board Lite installed on the remote host may be prone to cross-site scripting attacks due to its failure to properly sanitize input passed to the 'folderid' parameter of the 'pms.php' script. An attacker may be able to exploit this flaw to cause arbitrary HT...

PwsPHP profil.php id Parameter XSS

The remote host runs PWSPHP Portail Web System a CMS written in PHP. The remote version of this software is vulnerable to cross-site scripting attack due to a lack of sanity checks on the 'skin' parameter in the script SettingsBase.php. With a specially crafted URL, an attacker could use the remo...

Invision Power Board < 2.0.4 Multiple Vulnerabilities (SQLi, XSS)

According to its banner, the version of Invision Power Board on the remote host suffers from multiple vulnerabilities : - SQL Injection Vulnerability The application fails to sanitize user-input supplied through the 'passhash' cookie in the 'sources/login.php' script, which can be exploited to...

Invision Power Board index.php Multiple Parameter XSS

The version of Invision Power Board installed on the remote host suffers from a cross-site scripting vulnerability due to its failure to sanitize user input via the 'act' parameter to the 'index.php' script. An unauthenticated attacker can exploit this flaw by injecting malicious HTML and script...

osTicket <= 1.2.7 Multiple Vulnerabilities

The version of osTicket installed on the remote host suffers from several vulnerabilities : - A Remote File Include Vulnerability The script 'include/main.php' lets an attacker read arbitrary files on the remote host and possibly even run arbitrary PHP code, subject to the privileges of the web...

bBlog <= 0.7.4 Multiple Vulnerabilities (SQLi, XSS)

The remote host is running bBlog, an open source blog software application. According to its banner, the remote version of this software suffers from several vulnerabilities: - A SQL Injection Vulnerability It is reportedly possible to inject SQL statements through the 'postid' parameter of the...

Oracle Application Server 9i Webcache < 9.0.4.0 Multiple Vulnerabilities

According to its banner, the version of Oracle Application Server 9i Webcache installed on the remote host suffers from several flaws: - Arbitrary File Corruption Vulnerability An attacker may be able to corrupt arbitrary files on the remote host by passing the filenames through the 'cachedumpfil...

RM SafetyNet Plus snpfiltered.pl u Parameter XSS

The remote host is running SafetyNet Plus, an educational web filtering application. This version is vulnerable to a cross-site scripting attack. Input to the 'u' parameter of snpfiltered.pl is not properly sanitized. A remote attacker could exploit this by tricking a user into requesting a...

Horde Mnemo Detection

The remote host is running Mnemo, an open source PHP-based note manager from the Horde Project. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid18133; scriptversion"1.23"; scriptsetattributeattribute:"pluginmodificationdate", value:"2023/05/24"; scriptnameenglish:"Hor...

Horde Turba Detection

The remote host is running Turba, a PHP-based addressbook / contact management utility from the Horde Project. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid18137; scriptversion"1.24"; scriptsetattributeattribute:"pluginmodificationdate", value:"2022/10/12";...

Horde Nag Detection

The remote host is running Nag, an open source PHP-based multi-user task list manager from the Horde Project. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid18135; scriptversion"1.23"; scriptsetattributeattribute:"pluginmodificationdate", value:"2022/10/12";...

ArGoSoft Mail Server Pro <= 1.8.7.6 Multiple Vulnerabilities (XSS, Traversal, Priv Esc)

The version of ArGoSoft Mail Server Pro installed on the remote host suffers from several vulnerabilities, including : - Unauthenticated Account Creation Vulnerability The application does not authenticate requests sent through the web interface before creating mail accounts and may create them...

RHEL 3 : kernel (RHSA-2005:293)

Updated kernel packages that fix several security issues in the Red Hat Enterprise Linux 3 kernel are now available. This security advisory has been rated as having important security impact by the Red Hat Security Response Team. The Linux kernel handles the basic functions of the operating syste...

phpBB <= 2.0.14 Multiple Vulnerabilities

According to its banner, the remote host is running a version of phpBB that suffers from multiple flaws: - A BBCode Input Validation Vulnerability The application fails to properly filter for the BBCode URL in the 'includes/bbcode.php' script. With a specially crafted URL, an attacker could cause...

phpBB Knowledge Base Module kb.php cat Parameter SQL Injection

The installed version of phpBB on the remote host includes the Knowledge Base module, which does not properly sanitize input to the 'cat' parameter of the 'kb.php' script before using it in SQL queries. An attacker can exploit this flaw to modify database queries, potentially even uncovering user...

Serendipity exit.php Multiple Parameter SQL Injection

The version of Serendipity installed on the remote host allows an attacker to pass arbitrary SQL code through the 'urlid' and 'entryid' parameters of the 'exit.php' script. These flaws may lead to the disclosure / modification of data or attacks against the underlying database application...