CVE-2006-7101

The CVE-2006-7101 entry concerns PHPWind versions 5.0.1 and earlier where the admin.php component is vulnerable to SQL injection via the AdminUser cookie. The root cause is improper handling of the cookie leading to arbitrary SQL execution by remote attackers, with a high impact (base score 7.5)....

CVE-2006-7101: Undefined Security Weakness

SQL injection vulnerability in admin.php in PHPWind 5.0.1 and earlier allows remote attackers to execute arbitrary SQL commands via the AdminUser cookie...

CVE-2007-1255: Undefined Security Weakness

Unrestricted file upload vulnerability in admin.bbcode.php in Connectix Boards 0.7 and earlier allows remote authenticated administrators to execute arbitrary PHP code by uploading a crafted GIF smiley image with a .php extension via the uploadimage parameter to admin.php, which can be later...

CVE-2006-7074

CVE-2006-7074 affects SmartSiteCMS 1.0. The vulnerability is in admin.php, allowing remote attackers to bypass authentication and gain administrator privileges by setting the userName cookie. The connected documents confirm the flaw but do not provide exploitation steps, a broader impact beyond a...

CVE-2006-7074: Use of Hard-coded Credentials

admin.php in SmartSiteCMS 1.0 allows remote attackers to bypass authentication and gain administrator privileges by setting the userName cookie...

CVE-2006-7064: Undefined Security Weakness

Cross-site scripting XSS vulnerability in forum/admin.php for Invision Power Board IPB 2.1.6 and earlier allows remote attackers to inject arbitrary web script or HTML as the administrator via the phpinfo parameter...

CVE-2006-7014

admin.php in BloggIT 1.01 and earlier does not properly establish a user session, which allows remote attackers to gain privileges via a direct request...

CVE-2006-7014

CVE-2006-7014 affects BloggIT 1.01 and earlier. The issue is that admin.php does not properly establish a user session, enabling remote attackers to gain privileges via a direct request. The available connected documents confirm the affected software and the root cause (improper session establish...

CVE-2006-7016: Undefined Security Weakness

phpjobboard allows remote attackers to bypass authentication and gain administrator privileges via a direct request to admin.php with adminop=job-edit...

CVE-2006-7014: Undefined Security Weakness

admin.php in BloggIT 1.01 and earlier does not properly establish a user session, which allows remote attackers to gain privileges via a direct request...

CVE-2007-0835

admin.php in Coppermine Photo Gallery 1.4.10, and possibly earlier, allows remote authenticated users to execute arbitrary shell commands via shell metacharacters ";" semicolon in the "Command line options for ImageMagick" form field, when used as an option to ImageMagick's convert command. NOTE:...

CVE-2007-0835

admin.php in Coppermine Photo Gallery 1.4.10, and possibly earlier, allows remote authenticated users to execute arbitrary shell commands via shell metacharacters ";" semicolon in the "Command line options for ImageMagick" form field, when used as an option to ImageMagick's convert command. NOTE:...

CVE-2007-0835: Undefined Security Weakness

admin.php in Coppermine Photo Gallery 1.4.10, and possibly earlier, allows remote authenticated users to execute arbitrary shell commands via shell metacharacters ";" semicolon in the "Command line options for ImageMagick" form field, when used as an option to ImageMagick's convert command. NOTE:...

CVE-2007-0836: Undefined Security Weakness

admin.php in Coppermine Photo Gallery 1.4.10, and possibly earlier, allows remote authenticated users to include arbitrary local and possibly remote files via the 1 "Path to custom header include" and 2 "Path to custom footer include" form fields. NOTE: The provenance of this information is...

CVE-2007-0831: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Atsphp 5.0.1 allow remote attackers to execute arbitrary PHP code via a URL in the CONFpath parameter to 1 index.php, 2 sources/usercp.php, or 3 sources/admin.php. NOTE: Another researcher has disputed this vulnerability, noting that CONFpath ...

Cross site scripting

Cross-site scripting XSS vulnerability in admin.php in Interactive-Scripts.Com PHP Membership Manager 1.5 allows remote attackers to inject arbitrary web script or HTML via the p parameter...

CVE-2007-0567

Cross-site scripting XSS vulnerability in admin.php in Interactive-Scripts.Com PHP Membership Manager 1.5 allows remote attackers to inject arbitrary web script or HTML via the p parameter...

CVE-2007-0567

Cross-site scripting XSS vulnerability in admin.php in Interactive-Scripts.Com PHP Membership Manager 1.5 allows remote attackers to inject arbitrary web script or HTML via the p parameter...

CVE-2007-0567

The CVE-2007-0567 issue is an XSS vulnerability in Interactive-Scripts.Com PHP Membership Manager 1.5, exploitable via the _p parameter in admin.php. The root cause is unsanitized input leading to injection of arbitrary script/HTML. CVSS v2 base score is 6.8 (MEDIUM) with partial impacts on confi...

CVE-2007-0567: Undefined Security Weakness

Cross-site scripting XSS vulnerability in admin.php in Interactive-Scripts.Com PHP Membership Manager 1.5 allows remote attackers to inject arbitrary web script or HTML via the p parameter...