CVE-2009-4472: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in PHPope 1.0.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the 1 GLOBALSconfigdirplugins parameter to plugins/address/admin/index.php, 2 GLOBALSconfigdirfunctions parameter to plugins/im/compose.php, and 3...

moziloCMS Multiple Cross Site Scripting Vulnerabilities

The host is running moziloCMS and is prone to Multiple Cross Site Scripting Vulnerabilities OpenVAS Vulnerability Test $Id: gbmoziloCMSmultxssvuln.nasl 4869 2016-12-29 11:01:45Z teissa $ moziloCMS Multiple Cross Site Scripting Vulnerabilities Authors: Antu Sanadi Copyright: Copyright c 2009...

CVE-2009-4209: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in admin/index.php in moziloCMS 1.11.1 allow remote attackers to inject arbitrary web script or HTML via the 1 cat and 2 file parameters in an editsite action, different vectors than CVE-2008-6127 and CVE-2009-1367...

Bitrix Site Manager Remote File Inclusion

Author : Don Tukulesto [email protected] + Date : November 13, 2009 + Homepage : http://www.indonesiancoder.com + Vendor : http://www.bitrixsoft.com/ + Method : Remote File Inclusion + Location : INDONESIA Notes : I know this is an old bugs, but i just write this exploit under perl module...

Bitrix Site Manager Multiple Remote File Include Vulnerability

No description provided by source. + Author : Don Tukulesto [email protected] + Date : November 13, 2009 + Homepage : http://www.indonesiancoder.com + Vendor : http://www.bitrixsoft.com/ + Method : Remote File Inclusion + Location : INDONESIA Notes : I know this is an old bugs, but i just...

CVE-2009-3667

CVE-2009-3667 affects AdsDX 3.05. A SQL injection in admin/index.php via the Username parameter allows remote attackers to execute arbitrary SQL commands. Root cause: insufficient input validation/escaping enabling injection. Impact per sources: attacker could potentially access/modify data (part...

CVE-2009-3667: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/index.php in AdsDX 3.05 allows remote attackers to execute arbitrary SQL commands via the Username...

CVE-2009-3315

The affected software is NeLogic Nephp Publisher Enterprise (versions 3.5.9 and 4.5). The vulnerability is a SQL injection in admin/index.php via the Username field, caused by improper handling of input in the web application. This allows remote attackers to execute arbitrary SQL commands, with t...

CVE-2009-3315: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/index.php in NeLogic Nephp Publisher Enterprise 3.5.9 and 4.5 allows remote attackers to execute arbitrary SQL commands via the Username field...

Authentication flaw

OTManager CMS 2.4 allows remote attackers to bypass authentication and gain administrator privileges by setting the ADMINHora, ADMINLogado, and ADMINNome cookies to certain values, as reachable in Admin/index.php...

CVE-2008-7179

OTManager CMS 2.4 allows remote attackers to bypass authentication and gain administrator privileges by setting the ADMINHora, ADMINLogado, and ADMINNome cookies to certain values, as reachable in Admin/index.php...

CVE-2008-7179: Improper Authentication

OTManager CMS 2.4 allows remote attackers to bypass authentication and gain administrator privileges by setting the ADMINHora, ADMINLogado, and ADMINNome cookies to certain values, as reachable in Admin/index.php...

CVE-2008-7062: Undefined Security Weakness

Unrestricted file upload vulnerability in admin/index.php in Download Manager module 1.0 for LoveCMS 1.6.2 Final allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in uploads/...

CVE-2009-2388: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/index.php in Opial 1.0 allows remote attackers to execute arbitrary SQL commands via the txtPassword parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2009-2393: Undefined Security Weakness

admin/index.php in Virtuenetz Virtue Online Test Generator does not require administrative privileges, which allows remote authenticated users to have an unknown impact via unspecified vectors...

CVE-2009-2340

CVE-2009-2340 affects Opial 1.0: the admin/index.php module is vulnerable to SQL injection via the txtUserName (User Name) parameter, enabling remote execution of arbitrary SQL commands. Some sources also mention txtPassword and other parameters, but the core detail is the improper input filterin...

CVE-2009-2340: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/index.php in Opial 1.0 allows remote attackers to execute arbitrary SQL commands via the txtUserName aka User Name parameter. NOTE: some of these details are obtained from third party information...

tsep 0.942.02 - Multiple Vulnerabilities

tsep 0.942.02 - Multiple Vulnerabilities TSEP "0" && $percent = "100" 62: $sqlins = "INSERT INTO $dbtablename alttag,display,valuepercent,imageshow,comment 63: VALUES '$alt','$display',...

CVE-2009-2018

CVE-2009-2018 is a SQL injection vulnerability in the admin/index.php of Jared Eckersley’s MyCars. When magic_quotes_gpc is disabled, an attacker can craft the authuserid parameter to execute arbitrary SQL commands. The NVD entry rates it as a Medium impact (CVSSv2 6.8) with partial impact on con...

CVE-2009-2018: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/index.php in Jared Eckersley MyCars, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the authuserid parameter...