CVE-2008-6750

CVE-2008-6750 affects FlexPHPDirectory 0.0.1, where add.php allows unrestricted file uploads. An attacker can upload a file with an executable extension and then access it directly under photo/ to execute code remotely. The underlying issue is unrestricted upload handling in the web application, ...

Sql injection

Multiple SQL injection vulnerabilities in AV Book Library before 1.1 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to 1 admin/edit.php, 2 admin/add.php, 3 lib/booksearch.php, and possibly other components...

FlexPHPDirectory 0.0.1 SQL Injection

Autore: x0r Email: [email protected] Site: http://w00tz0ne.altervista.org/index.php Cms: Flexphpdiren Version: 0.0.1 Download: http://www.china-on-site.com/flexphpdir/ Bug In \admin\usercheck.php 'n' \add.php $sql = "select username,adminid from linkexadmin where username='$checkuser' and...

Crlf injection

Multiple CRLF injection vulnerabilities in AIST NetCat 3.12 and earlier allow remote attackers to have an unknown impact via unspecified vectors involving 1 a %0a sequence in a cookie and 2 the add.php file...

CVE-2008-4341

add.php in MyBlog 0.9.8 and earlier allows remote attackers to bypass authentication and gain administrative access by setting a cookie with admin=yes and login=admin...

CVE-2008-4341

add.php in MyBlog 0.9.8 and earlier allows remote attackers to bypass authentication and gain administrative access by setting a cookie with admin=yes and login=admin...

MyBlog 0.9.8 - Insecure Cookie Handling

MyBlog 0.9.8 - Insecure Cookie Handling -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= MyBlog eNYe-Sec - www.enye-sec.org MyBlog is an open source Blog/CMS project. It allows begginers to have a simple to use blog/cms and it will still please developers with feature packed...

onenews Beta 2 - Cross-Site Scripting / HTML Injection / SQL Injection

///////////////\\\\\\\\ Name : OneNews Beta 2 Multiple Vulnerabilities Author : suN8HclfcrimsoNLoyd9, DaRk-CodeRs Group Source : http://sourceforge.net/project/showfiles.php?groupid=193198 Dork : Powered by One-News Greetz : all DaRk-CodeRs guys, e.wiZz, str0ke ========================== |1...

Cross-Site Scripting vulnerabilities in CNCat

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Cross-Site Scripting уязвимостях в CNCat. XSS: Уязвимости в add.php можно как через GET, так и через POST, search.php и index.php. http://site/add.php?description=3C/textarea3E3Cscript3Ealertdocument.cookie3C/script3E...

phpglossar-rfi.txt

?????????? ??????????????? ??????????????????? ??????????????????????? ?????????????????????????? ?????????????????????????????? ????????????????????????????????? ??????????????????????????????????? ????????????????????????????????????? ???????????????????????????????????????...

PHPGlossar Format_Menue远程文件包含漏洞

PHPGlossar是一款基于PHP的WEB应用程序。 PHPGlossar不正确过滤用户提交的输入，远程攻击者可以利用漏洞以WEB权限执行任意命令。 问题是多个脚本对用户提交的'formatmenue'参数缺少过滤，指定远程服务器上的文件作为包含参数，可导致以WEB权限执行任意命令。 PHPGlossar 0.8 目前没有解决方案提供： http://www.crear.de/2003/dienste/phpdownloadlinks0.6/loadpage.php?uid=7...

PHPGlossar 0.8 (format_menue) Remote File Inclusion Vulnerabilities

No description provided by source. ?????????? ??????????????? ??????????????????? ??????????????????????? ?????????????????????????? ?????????????????????????????? ????????????????????????????????? ??????????????????????????????????? ?????????????????????????????????????...

PHPGlossar 0.8 (format_menue) Remote File Inclusion Vulnerabilities

Exploit for unknown platform in category web applications =================================================================== PHPGlossar 0.8 formatmenue Remote File Inclusion Vulnerabilities =================================================================== ?????????? ???????????????...

PHPGlossar 0.8 - format_menue Remote File Inclusion

PHPGlossar 0.8 - formatmenue Remote File Inclusion ?????????? ??????????????? ??????????????????? ??????????????????????? ?????????????????????????? ?????????????????????????????? ????????????????????????????????? ??????????????????????????????????? ?????????????????????????????????????...

CVE-2007-2169

Static code injection vulnerability in add.php in Mozzers SubSystem 1.0 allows remote attackers to inject PHP code into subs.php via the 1 Sub-name or 2 Sub-url field. NOTE: an earlier report indicated that the add action can be reached through a request to index.php...

CVE-2007-2169

Static code injection vulnerability in add.php in Mozzers SubSystem 1.0 allows remote attackers to inject PHP code into subs.php via the 1 Sub-name or 2 Sub-url field. NOTE: an earlier report indicated that the add action can be reached through a request to index.php...

Mozzers SubSystem Add.PHP任意代码执行漏洞

Mozzers SubSystem是一款基于PHP的WEB应用程序。 Mozzers SubSystem不正确过滤用户提交的输入，远程攻击者可以利用漏洞以WEB权限执行任意命令。 问题是'Add.PHP'脚本对用户提交的WEB参数缺少过滤，指定远程服务器上的文件作为包含参数，可导致以WEB权限执行任意命令。 Mozzers SubSystem Mozzers SubSystem 1.0 目前没有解决方案提供： http://sourceforge.net/projects/subsystem/...

CVE-2006-6463

The CVE-2006-6463 entry concerns Midicart’s admin/add.php, where an unrestricted file upload vulnerability exists. According to PT-2006-7072, remote authenticated users can upload arbitrary files (potentially including .php) to the images/ directory under the web root via the admin/add.php endpoi...

CVE-2006-3923

Cross-site scripting XSS vulnerability in add.php in Fire-Mouse Toplist 1.1 and earlier, when registerglobals is enabled, allows remote attackers to inject arbitrary web script or HTML via the Seitenname parameter...

saphp "add.php" forumid Parameter SQL Injection

=========================================== Discovered By: C.B.B.L CrAzY CrAcKeR ,Breeeeh ,BoNy-m ,LiNuXrOOt =========================================== Search:- powered by: saphp Example:- story/add.php?forumid=SQL Injection ===========================================...