CVE-2009-4446

Cross-site scripting XSS vulnerability in admin.php in phpInstantGallery 1.1 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO...

CVE-2009-4446

CVE-2009-4446 describes an XSS in phpInstantGallery 1.1 (admin.php) exploitable via PATH_INFO. Exploitation by remote attackers is possible without authentication; impacts include partial integrity breach and no confidentiality/availability effects per CVSS? (Base 4.3, MEDIUM). Connected document...

CVE-2009-4446: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin.php in phpInstantGallery 1.1 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO...

CVE-2009-4365: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in admin.php in ScriptsEz Ez Blog 1.0 allow remote attackers to hijack the authentication of administrators for requests that 1 add a blog via the addblog action, 2 approve a comment via the approvecomment action, 3 change administrator...

CVE-2009-4262: Undefined Security Weakness

Harold Bakker's NewsScript HB-NS 1.3 allows remote attackers to obtain access to the admin control panel via a direct request to admin.php...

CVE-2009-4222: Undefined Security Weakness

phpBazar 2.1.1fix and earlier does not require administrative authentication for admin/admin.php, which allows remote attackers to obtain access to the admin control panel via a direct request...

Directory traversal

Directory traversal vulnerability in admin.php in Flashlight Free Edition allows remote attackers to include and execute arbitrary local files via a .. dot dot in the action parameter...

CVE-2009-4205

Directory traversal vulnerability in admin.php in Flashlight Free Edition allows remote attackers to include and execute arbitrary local files via a .. dot dot in the action parameter...

CVE-2009-4205

Flashlight Free Edition (

CVE-2009-4205: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in admin.php in Flashlight Free Edition allows remote attackers to include and execute arbitrary local files via a .. dot dot in the action parameter...

CVE-2009-4121

CVE-2009-4121 refers to multiple CSRF vulnerabilities in Quick.CMS 2.4 and Quick.CMS.Lite 2.4 . The flaws allow remote attackers to hijack an administrator’s authenticated session to perform actions such as (1) deleting web pages via a p-delete action to admin.php, and possibly (2) deleting produ...

CVE-2009-4120: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in Quick.Cart 3.4 allow remote attackers to hijack the authentication of the administrator for requests that 1 delete orders via an orders-delete action to admin.php, and possibly 2 delete products or 3 delete pages via unspecified vectors...

CVE-2009-4121: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in Quick.CMS 2.4 and Quick.CMS.Lite 2.4 allow remote attackers to hijack the authentication of the administrator for requests that 1 delete web pages via a p-delete action to admin.php, and possibly 2 delete products or 3 delete orders via...

WordPress 2.0 - 2.7.1 admin.php Module Configuration Security Bypass Vulnerability

No description provided by source. An attacker can exploit this issue via a browser. The following example URIs are available: http://www.example.com/wp-admin/admin.php?page=/collapsing-archives/options.txt http://www.example.com/wp-admin/admin.php?page=akismet/readme.txt...

WordPress 2.0 2.7.1 - admin.php Module Configuration Security Bypass

WordPress 2.0 2.7.1 - admin.php Module Configuration Security Bypass An attacker can exploit this issue via a browser. The following example URIs are available: http://www.example.com/wp-admin/admin.php?page=/collapsing-archives/options.txt...

CVE-2009-3716: Undefined Security Weakness

Unrestricted file upload vulnerability in admin.php in MCshoutbox 1.1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in smilies/...

Skybluecanvas 1.1 r237 - 'admin.php' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/44225/info SkyBlueCanvas is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in...

QuickCart 3.x xss xsrf Local File Inclusion Directory Traversal

No description provided by source. DISCOVERED: Paweł 'kl3ryk' Łaskarzewski GREETZ: hawk, pin3ska, black ant, qwert666, ua and gacmaan DIRECTORY TRAVERSAL http://victim.com/?p=ONE OF THE EXISITING FILES-EXISITING ACTION IN THIS FILE- Most of actions load templates form bad directory and then thr...

CVE-2009-3508: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in MUJE CMS 1.0.4.34 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the 1 class parameter to admin.php and the 2 url parameter to install/install.php; and allow remote authenticated administrators to read...

CVE-2008-7221

RunCMS 1.6.1 is affected by a CSRF vulnerability that lets remote attackers hijack administrator sessions by sending crafted requests to system/admin.php, enabling (1) addition of new administrators or (2) modification of user profiles. The vulnerability is triggered through authenticated admin a...