CVE-2008-1651: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in admin/login.php in EasyNews 4.0 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the lang parameter...

CVE-2008-1493

Directory traversal vulnerability in login.php in Cuteflow Bin 1.5.0 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the language parameter...

CVE-2008-1493

CVE-2008-1493 affects Cuteflow Bin 1.5.0 in login.php. The language parameter is processed insecurely, enabling directory traversal with ".." to include and execute local files. This has potential partial impact to confidentiality, integrity, and availability (CVSS v2 base score 7.5, AV:N/AC:L/Au...

CVE-2008-1493: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in login.php in Cuteflow Bin 1.5.0 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the language parameter...

cuteflowbin-lfi.txt

Cuteflow Bin v1.5.0 Local File Inclusion Vulnerability + Author : KnocKout + Cyber-Warrior.org / Bug Researchers Group Special Thanks : CW ALL USERS / Mr.Freeman ============================================== Script : Cuteflow Bin v1.5.0 Download :...

CVE-2008-1464: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Gallarific Free Edition 1.1 allow remote attackers to execute arbitrary SQL commands via the 1 query parameter to a search.php; 2 gusername and 3 gpassword parameters to b login.php; and the 4 username and 5 password parameters to c gadmin/index.php in a...

Cuteflow Bin 1.5.0 (login.php) Local File Inclusion Vulnerability

Exploit for unknown platform in category web applications ================================================================= Cuteflow Bin 1.5.0 login.php Local File Inclusion Vulnerability ================================================================= Cuteflow Bin v1.5.0 Local File Inclusion...

Cuteflow Bin 1.5.0 - login.php Local File Inclusion

Cuteflow Bin 1.5.0 - login.php Local File Inclusion Cuteflow Bin v1.5.0 Local File Inclusion Vulnerability + Author : KnocKout + Cyber-Warrior.org / Bug Researchers Group Special Thanks : CW ALL USERS / Mr.Freeman ============================================== Script : Cuteflow Bin v1.5.0 Downloa...

Unfixed XSS vulnerability at www.urgo.es

Security researcher THEMILLER, has submitted on 03/04/2008 a cross-site-scripting XSS vulnerability affecting www.urgo.es, which at the time of submission ranked 8648906 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 03/04/2008. It is currentl...

CVE-2008-0919: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in session/login.php in Open Source Security Information Management OSSIM 0.9.9 rc5 and earlier allows remote attackers to inject arbitrary web script or HTML via the dest parameter...

Sql injection

SQL injection vulnerability in login.php in Pedro Santana Codice CMS allows remote attackers to execute arbitrary SQL commands via the username field. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-0651

SQL injection vulnerability in login.php in Pedro Santana Codice CMS allows remote attackers to execute arbitrary SQL commands via the username field. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-0650

SQL injection vulnerability in login.php in Simple OS CMS 0.1c beta allows remote attackers to execute arbitrary SQL commands via the username field. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-0650

Vulnerability summary (CVE-2008-0650): In Simple OS CMS 0.1c beta, the login.php username field is susceptible to SQL injection, enabling remote attackers to execute arbitrary SQL commands. This affects the login process and can impact confidentiality, integrity, and availability (as per NVD metr...

CVE-2008-0651

The CVE-2008-0651 entry refers to a SQL injection vulnerability in login.php of Codice CMS, where the username field allows remote attackers to execute arbitrary SQL commands. The provided documents consistently describe this same issue, including the root cause (injection in login handling) and ...

CVE-2008-0651: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in login.php in Pedro Santana Codice CMS allows remote attackers to execute arbitrary SQL commands via the username field. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-0650: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in login.php in Simple OS CMS 0.1c beta allows remote attackers to execute arbitrary SQL commands via the username field. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

WordPress MU 1.3.2 - active_plugins option Code Execution

WordPress MU 1.3.2 - activeplugins option Code Execution Website : http://www.buayacorp.com/ Advisory: http://www.buayacorp.com/files/wordpress/wordpress-mu-options-overwrite.html This exploit uses activeplugins option to execute arbitrary PHP / includeonce './class-snoopy.php'; // Fix Snoopy cla...

Codice CMS - login.php SQL Injection

Codice CMS - login.php SQL Injection source: https://www.securityfocus.com/bid/27592/info Codice CMS is prone to an SQL-injection vulnerability because it fails to adequately sanitize user-supplied data. A successful exploit may allow an attacker to compromise the application, access or modify...

CVE-2008-0538: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in phpIP Management 4.3.2 allow remote attackers to execute arbitrary SQL commands via the 1 password parameter to login.php, the 2 id parameter to display.php, and unspecified other vectors. NOTE: some of these details are obtained from third party...