CVE-2008-3398

Multiple cross-site scripting XSS vulnerabilities in XRMS CRM 1.99.2 allow remote attackers to inject arbitrary web script or HTML via the msg parameter to unspecified components, possibly including login.php. NOTE: this may overlap CVE-2008-1129...

CVE-2008-3398: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in XRMS CRM 1.99.2 allow remote attackers to inject arbitrary web script or HTML via the msg parameter to unspecified components, possibly including login.php. NOTE: this may overlap CVE-2008-1129...

CVE-2008-3303: Undefined Security Weakness

admin/login.php in BilboBlog 0.2.1, when registerglobals is enabled, allows remote attackers to bypass authentication and obtain administrative access via a direct request that sets the login, adminlogin, password, and adminpasswd parameters...

CVE-2008-3212: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Scripteen Free Image Hosting Script 1.2.1 allow remote attackers to execute arbitrary SQL commands via the 1 username or 2 password parameter to admin/login.php, or the 3 uname or 4 pass parameter to login.php. NOTE: the provenance of this information is...

Design/Logic Flaw

myWebland myBloggie 2.1.6 allow remote attackers to obtain sensitive information via 1 an invalid year parameter to calendar.php, reached through index.php; 2 a direct request to common.php; and 3 a mode array parameter in the query string to login.php, which reveal the installation path in vario...

CVE-2007-3650

myWebland myBloggie 2.1.6 allow remote attackers to obtain sensitive information via 1 an invalid year parameter to calendar.php, reached through index.php; 2 a direct request to common.php; and 3 a mode array parameter in the query string to login.php, which reveal the installation path in vario...

CVE-2007-3650: Exposure of Sensitive Information to an Unauthorized Actor

myWebland myBloggie 2.1.6 allow remote attackers to obtain sensitive information via 1 an invalid year parameter to calendar.php, reached through index.php; 2 a direct request to common.php; and 3 a mode array parameter in the query string to login.php, which reveal the installation path in vario...

Sql injection

Multiple SQL injection vulnerabilities in PHPEasyData 1.5.4 allow remote attackers to execute arbitrary SQL commands via 1 the annuaire parameter to annuaire.php or 2 the username field in admin/login.php...

CVE-2008-2995

PHPEasyData 1.5.4 contains multiple SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands. The affected entry notes two injection vectors: (1) the annuaire parameter to annuaire.php and (2) the username field in admin/login.php. The NVD listing documents a CV...

Session fixation

Multiple session fixation vulnerabilities in Academic Web Tools AWT YEKTA 1.4.3.1, and 1.4.2.8 and earlier, allow remote attackers to hijack web sessions by setting the PHPSESSID parameter to 1 index.php and 2 login.php in homepg/...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Academic Web Tools AWT YEKTA 1.4.3.1, and 1.4.2.8 and earlier, allow remote attackers to inject arbitrary web script or HTML via the 1 query string to login.php and the 2 glbsid parameter to hta/htmlarea.js.php, and allow remote authenticated...

CVE-2008-2979: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in phpi/login.php in Ourvideo CMS 9.5 allow remote attackers to inject arbitrary web script or HTML via the 1 toppage and 2 endpage parameters...

CVE-2008-2970: Improper Input Validation

Multiple session fixation vulnerabilities in Academic Web Tools AWT YEKTA 1.4.3.1, and 1.4.2.8 and earlier, allow remote attackers to hijack web sessions by setting the PHPSESSID parameter to 1 index.php and 2 login.php in homepg/...

CVE-2008-2967: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Academic Web Tools AWT YEKTA 1.4.3.1, and 1.4.2.8 and earlier, allow remote attackers to inject arbitrary web script or HTML via the 1 query string to login.php and the 2 glbsid parameter to hta/htmlarea.js.php, and allow remote authenticated...

Scientific Image DataBase 0.41 - Blind SQL Injection

!/usr/bin/perl use strict; use warnings; use LWP::UserAgent; Download: http://sidb.sourceforge.net/ Dork: "Scientific Image DataBase" This exploit retrives the admin username/password via blind mysql injection. print ; my $substr, $done, $chr, $res = 1, 1, 48, ""; my $ua = LWP::UserAgent-new agen...

Sql injection

SQL injection vulnerability in login.php in Gryphon gllcTS2 4.2.4 allows remote attackers to execute arbitrary SQL commands via the detail parameter...

CVE-2008-2746

CVE-2008-2746: A SQL injection vulnerability in login.php of Gryphon gllcTS2 4.2.4 allows remote attackers to execute arbitrary SQL commands via the detail parameter. According to the records, the vulnerability affects login.php and enables potential partial disclosure of information, with partia...

CVE-2008-2746: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in login.php in Gryphon gllcTS2 4.2.4 allows remote attackers to execute arbitrary SQL commands via the detail parameter...

CVE-2008-2690

Multiple PHP remote file inclusion vulnerabilities in BrowserCRM 5.002.00, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the bcrmpubroot parameter to 1 kb.php, 2 login.php, 3 index.php, 4 contactview.php, and 5 contact.php in pub/, different...

gllcts2-sql.txt

?php / 08000000088@M@@@M@2ZZZ8@aZX;ii,,:,iir777777777777777777777777r;i:, i ,@X:i:0a7 BMMM88000000000 08888888882aMMMMM,SZZ0WZ ........ 7a2MMMMM : MMM@aZ888888888 08888888888WMMMMM78aSXi XBMMMMMMMMMMMMMM2: MB.X:. ,SMMMMMMMMMMMM. r: MMM0a8888888888 0888888888ZZMMMMS :...