Web Wiz Forums Registration Rules XSS Vulnerability

------------------------------------------------------ WEB WIZ FORUMS REGISTRATION RULES XSS VULNERABILITY ------------------------------------------------------ Online URL : http://ferruh.mavituna.com/article/?528 XSS / Cross Site Scripting attack allows an attacker to hijack other...

Invision Power Board ssi.php f Parameter SQL Injection

A vulnerability exists in the version of Invision Power Board on the remote host such that unauthorized users can inject SQL commands through the 'ssi.php' script. An attacker may use this flaw to gain the control of the remote database. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. From:...

jPortal print.inc.php id Parameter SQL Injection

The remote host appears to be running the jPortal CGI suite. There is a SQL injection vulnerability in the 'id' parameter of print.php. A remote attacker could exploit this to execute arbitrary SQL queries, which could be used to gain administrative access to this host. %NASLMINLEVEL 70300 C...

Nuked-Klan index.php user_langue Parameter Traversal Arbitrary File Access

Nuked-klan is installed on the remote host. There is a bug in this version that could allow an attacker to include php files hosted on a third-party website, thus allowing an attacker to execute arbitrary commands on this host. Another bug allows an attacker to read arbitrary files on the remote...

Invision Power Board index.php pop Parameter XSS

There is a bug in the version of Invision Power Board on the remote host that makes it vulnerable to cross-site scripting attacks. An attacker may exploit this issue to steal the credentials of legitimate users of this site. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

vBulletin search.php query Parameter XSS

There is a cross-site scripting issue in vBulletin that may allow an attacker to steal a user's cookies. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; ifdescription scriptid12058; scriptversion"1.24"; scriptcveid"CVE-2004-2076";...

Cross Site Scripting in VBulletin forum software

Client side execution of malicious scripts cross-site scripting Test Impact Customer session and cookies may be compromised. The attacker may be able to pose as a legitimate user to view and alter user records, and perform transactions as that user. From the polarised perspective, a user may only...

Mambo Site Server itemid Parameter XSS

An attacker may use the installed version of Mambo Site Server to perform a cross-site scripting attack on the remote host. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid12045; scriptversion"1.20";...

Photopost PHP Pro photo Parameter SQL Injection

The version of Photopost PHP Pro installed on the remote host fails to sanitize user-supplied input to the 'photo' parameter of the 'showphoto.php' script before using it in a database query. An unauthenticated attacker may be able to exploit this issue to uncover sensitive information, modify...

Qualiteam X-Cart Multiple Script perl_binary Parameter Arbitrary Command Execution

The remote host is running Qualiteam X-Cart - a shopping cart software written in PHP. There is a bug in this software that could allow an attacker to execute arbitrary commands on the remote web server with the privileges of the web user. In addition to this, there are some flaws that could allo...

phpMyAdmin export.php what Parameter Traversal Arbitrary File Access

There is a bug in the remote version of phpMyAdmin that may allow an attacker to read arbitrary files on the remote web server with the privileges of the web user or even execute arbitrary PHP code. Successful exploitation of this issue requires that PHP's 'magicquotesgpc' setting be disabled...

Leif Wright Web Blog blog.cgi ViewFile Request file Parameter Arbitrary Command Execution

The remote host is running LeifWright's blog.cgi - a CGI designed to handle personal web logs or 'blogs'. There is a bug in this software that could allow an attacker to execute arbitrary commands on the remote web server with the privileges of the web user. %NASLMINLEVEL 70300 C Tenable Network...

PJ CGI Neo PJreview_Neo.cgi p Parameter Traversal Arbitrary File Access

The remote host is running PJreviewneo.cgi - a web-based software. There is a bug in this software which may allow an attacker to read arbitrary files on the remote web server with the privileges of the web user. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc...

Mambo mod_mainmenu.php mosConfig_absolute_path Parameter Remote File Inclusion

There is a flaw in the installed version of Mambo Open Source that may allow an attacker to execute arbitrary remote PHP code on this host because it fails to sanitize input to the 'mosConfigabsolutepath' of 'modules/modmainmenu.php' before using it to include PHP code from another file. Note tha...

Multiple vulnerabilities in WWW Fileshare Pro <= 2.42

Luigi Auriemma Application: WWW File Share Pro http://www.wfshome.com Versions: = 2.42 Platforms: Windows Bugs: - arbitrary server's files overwriting - remote crash - directory authorization bypass Risk: critical Exploitation: remote Date: 14 Jan 2004 Author: Luigi Auriemma e-mail:...

wwwfilesharepro.txt

Luigi Auriemma Application: WWW File Share Pro http://www.wfshome.com Versions: From the vendor's website: "WWW File Share Pro is a small HTTP server that can help you share files with your friends. They can download files from your computer or upload files from theirs. Simply specify a directory...

vBulletin calendar.php eventid Parameter SQL Injection

A vulnerability has been discovered in the 'calendar.php' script that allows unauthorized users to inject SQL commands through the 'eventid' parameter. An attacker may use this flaw to gain the control of the remote database. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Ref: From:...

QuikStore Shopping Cart quikstore.cgi template Parameter Traversal Arbitrary File Access

The CGI 'quickstore.cgi' is installed. This CGI has a well known security flaw that lets an attacker read arbitrary files with the privileges of the HTTP daemon. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Ref: Date: Tue, 23 Dec 2003 20:27:51 +0800 From: DrPonidi Haryanto Subject:...

BGP Service Detection

The remote host is running BGP, a popular routing protocol. This indicates that the remote host is probably a network router. C Tenable Network Security, Inc. See RFC 1771 include"compat.inc"; ifdescription scriptid11907; scriptversion "1.13"; scriptcvsdate"Date: 2019/11/22"; scriptnameenglish:"B...

Gallery index.php GALLERY_BASEDIR Parameter Remote File Inclusion

The version of Gallery hosted on the remote web server is affected by a remote file inclusion vulnerability due to the application failing to properly sanitize user-supplied input to the 'GALLERYBASEDIR' parameter of the 'index.php' script. An attacker may use this flaw to inject arbitrary code i...