Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the savemain operation in the adperms section in admin.php in MKPortal allows remote attackers to modify privilege settings, as demonstrated using a getURL of admin.php within a .swf file contained in an IFRAME element, aka the "All Guests are Admi...

CVE-2007-0192

Cross-site request forgery CSRF vulnerability in the savemain operation in the adperms section in admin.php in MKPortal allows remote attackers to modify privilege settings, as demonstrated using a getURL of admin.php within a .swf file contained in an IFRAME element, aka the "All Guests are Admi...

Cross site scripting

Cross-site scripting XSS vulnerability in admin.php in MKPortal allows remote attackers to inject arbitrary web script or HTML via two certain fields in a contentsnew operation in the adcontents section...

CVE-2006-6920

Cross-site scripting XSS vulnerability in Nucleus before 3.24 allows remote attackers to inject arbitrary web script or HTML via unknown vectors, possibly involving 1 lib/ADMIN.php and 2 lib/SKIN.php...

CVE-2006-6920

Cross-site scripting XSS vulnerability in Nucleus before 3.24 allows remote attackers to inject arbitrary web script or HTML via unknown vectors, possibly involving 1 lib/ADMIN.php and 2 lib/SKIN.php...

CVE-2006-6920

CVE-2006-6920 describes a cross-site scripting (XSS) vulnerability in Nucleus CMS prior to version 3.24. The issue allows remote attackers to inject arbitrary web script or HTML via unknown vectors, possibly involving lib/ADMIN.php and lib/SKIN.php. JVN details indicate that an arbitrary script c...

CVE-2007-0192

The CVE-2007-0192 CSRF vulnerability affects MKPortal’s admin.php in the save_main operation (ad_perms) where an attacker can induce privilege changes. The issue is exposed via a crafted getURL in a .swf loaded in an IFRAME, enabling remote modification of privilege settings (All Guests are Admin...

CVE-2006-6920: Undefined Security Weakness

Cross-site scripting XSS vulnerability in Nucleus before 3.24 allows remote attackers to inject arbitrary web script or HTML via unknown vectors, possibly involving 1 lib/ADMIN.php and 2 lib/SKIN.php...

CVE-2007-0192: Undefined Security Weakness

Cross-site request forgery CSRF vulnerability in the savemain operation in the adperms section in admin.php in MKPortal allows remote attackers to modify privilege settings, as demonstrated using a getURL of admin.php within a .swf file contained in an IFRAME element, aka the "All Guests are Admi...

CVE-2007-0194: Undefined Security Weakness

admin.php in MKPortal M1.1 RC1 allows remote attackers to obtain sensitive information via a direct request with an MKPATH=1 query string, which reveals the path in an error message...

CVE-2007-0191: Undefined Security Weakness

Cross-site scripting XSS vulnerability in admin.php in MKPortal allows remote attackers to inject arbitrary web script or HTML via two certain fields in a contentsnew operation in the adcontents section...

CVE-2006-6871

CVE-2006-6871 affects eNdonesia 8.4 with four XSS vectors : (1) mod.php viewlink parameter (mod), (2) informasi module showinfo intypeid, (3) the "your Friend" field in friend.php, (4) the "Main Text" field in admin.php. The vulnerability allows remote attackers to inject arbitrary web script or ...

CVE-2006-6871: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in eNdonesia 8.4 allow remote attackers to inject arbitrary web script or HTML via 1 the mod parameter in a viewlink operation in mod.php, 2 the intypeid parameter in a showinfo operation in the informasi module in mod.php, 3 the "your Friend" fie...

CVE-2006-6871

Multiple cross-site scripting XSS vulnerabilities in eNdonesia 8.4 allow remote attackers to inject arbitrary web script or HTML via 1 the mod parameter in a viewlink operation in mod.php, 2 the intypeid parameter in a showinfo operation in the informasi module in mod.php, 3 the "your Friend" fie...

CVE-2006-6812: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in myPHPCalendar 10.1 allow remote attackers to execute arbitrary PHP code via a URL in the caldir parameter to 1 admin.php, 2 contacts.php, or 3 convert-date.php...

CVE-2006-6763: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in the Keep It Simple Guest Book KISGB allow remote attackers to execute arbitrary PHP code via a URL in the 1 pathtothemes parameter in a authenticate.php, and the 2 defaultpathforthemes parameter in b admin.php and c upconfig.php...

eNdonesia 8.4 (mod.php/friend.php/admin.php) Multiple Vulnerabilities

No description provided by source. bugs for Endonesia8.4 FInd:z1ckXru mail:[email protected] 1 http://localhost/en/mod.php?mod=XSS&op=viewlink&cid=5 2 http://localhost/en/friend.php your Friend:XSS 3 http://localhost/en/admin.php Main Text: XSS 4...

eNdonesia 8.4 (mod.php/friend.php/admin.php) Multiple Vulnerabilities

Exploit for unknown platform in category web applications ===================================================================== eNdonesia 8.4 mod.php/friend.php/admin.php Multiple Vulnerabilities ===================================================================== bugs for Endonesia8.4...

eNdonesia 8.4 - mod.phpfriend.phpadmin.php Multiple Vulnerabilities

eNdonesia 8.4 - mod.phpfriend.phpadmin.php Multiple Vulnerabilities bugs for Endonesia8.4 FInd:z1ckXru mail:[email protected] 1 http://localhost/en/mod.php?mod=XSS&op=viewlink&cid=5 2 http://localhost/en/friend.php your Friend:XSS 3 http://localhost/en/admin.php Main Text: XSS 4...

CVE-2006-6722: Undefined Security Weakness

Bandwebsite aka Bandsite portal system 1.5 allows remote attackers to create administrative accounts via a direct request to admin.php with the Login parameter set to 1...