2947 matches found
CVE-2001-1524: Undefined Security Weakness
Cross-site scripting XSS vulnerability in PHP-Nuke 5.3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the 1 uname parameter in user.php, 2 ttitle, letter and file parameters in modules.php, 3 subject, story and storyext parameters in submit.php, 4 upload paramete...
CVE-2005-2203
CVE-2005-2203 affects phpWishlist prior to 0.1.15. The vulnerability allows remote attackers to bypass authentication by issuing a direct request to admin.php, enabling access without valid credentials. Root cause details are not provided in the documents beyond the bypass vector. Impact is descr...
CVE-2005-2203
login.php in phpWishlist before 0.1.15 allows remote attackers to bypass authentication via a direct request to admin.php...
CVE-2005-2203
login.php in phpWishlist before 0.1.15 allows remote attackers to bypass authentication via a direct request to admin.php...
CVE-2005-2203: Undefined Security Weakness
login.php in phpWishlist before 0.1.15 allows remote attackers to bypass authentication via a direct request to admin.php...
CVE-2004-2180
WowBB Forum 1.61 and earlier versions are affected by multiple cross-site scripting (XSS) vulnerabilities. The flaws allow attackers to inject arbitrary script/HTML via numerous vectors: country (view_user.php), show (view_forum.php), letter (view_user.php), highlight (view_topic.php), show (inde...
CVE-2004-2180: Undefined Security Weakness
Multiple cross-site scripting XSS vulnerabilities in WowBB Forum 1.61 allow remote attackers to inject arbitrary web script or HTML via the 1 country parameter to viewuser.php, 2 show parameter to viewforum.php, 3 letter parameter to viewuser.php, 4 highlight parameter to viewtopic.php, 5 show...
CVE-2005-1998
CVE-2005-1998 is a directory traversal vulnerability affecting McGallery 1.1, where the lang parameter can be exploited with .. to read arbitrary files from the server. The commonly cited references (NVD, CVE List, CVE.org) confirm the issue and the affected product/version, but the materials do ...
CVE-2005-1998: Undefined Security Weakness
Directory traversal vulnerability in admin.php in McGallery 1.1 allows remote attackers to read arbitrary files via a .. dot dot in the lang parameter...
CVE-2005-1803
CVE-2005-1803 affects Net Portal Dynamic System (NPDS) 5.0. The description lists multiple XSS vectors: via the language parameter to admin.php or powerpack_f.php; the sitename parameter to sdv_infos.php; the categories parameter to faq.php; the lettre parameter to the glossaire module; the title...
CVE-2005-1803
Multiple cross-site scripting XSS vulnerabilities in Net Portal Dynamic System NPDS 5.0 allow remote attackers to inject arbitrary web script or HTML via the language parameter to 1 admin.php, or 2 powerpackf.php, 3 the sitename parameter to sdvinfos.php, 4 the categories parameter to faq.php, 5...
CVE-2005-1803: Undefined Security Weakness
Multiple cross-site scripting XSS vulnerabilities in Net Portal Dynamic System NPDS 5.0 allow remote attackers to inject arbitrary web script or HTML via the language parameter to 1 admin.php, or 2 powerpackf.php, 3 the sitename parameter to sdvinfos.php, 4 the categories parameter to faq.php, 5...
CVE-2004-1842
PHP-Nuke 6.x through 7.1.0 is affected by a CSRF that lets an attacker gain administrative privileges via an image tag pointing to admin.php. The PT-2004-2741 entry confirms the issue and recommends upgrading to a version containing the fix; no specific fixed version is provided in the sources.
CVE-2004-1842
Cross-site request forgery CSRF vulnerability in Php-Nuke 6.x through 7.1.0 allows remote attackers to gain administrative privileges via an img tag with a URL to admin.php...
CVE-2004-1842: Cross-Site Request Forgery (CSRF)
Cross-site request forgery CSRF vulnerability in Php-Nuke 6.x through 7.1.0 allows remote attackers to gain administrative privileges via an img tag with a URL to admin.php...
CVE-2004-1932: Undefined Security Weakness
SQL injection vulnerability in 1 auth.php and 2 admin.php in PHP-Nuke 6.x through 7.2 allows remote attackers to execute arbitrary SQL code and create an administrator account via base64-encoded SQL in the admin parameter...
CVE-2005-1437: Undefined Security Weakness
Multiple SQL injection vulnerabilities in osTicket allow remote attackers to execute arbitrary SQL commands via the 1 id parameter to admin.php or 2 cat parameter to view.php...
CVE-2005-1049
Multiple cross-site scripting vulnerabilities in PostNuke 0.760-RC3 allow remote attackers to inject arbitrary web script or HTML via the 1 module parameter to admin.php or 2 op parameter to user.php. NOTE: the vendor reports that certain issues could not be reproduced for 760 RC3, or for .750...
CVE-2005-1049: Undefined Security Weakness
Multiple cross-site scripting vulnerabilities in PostNuke 0.760-RC3 allow remote attackers to inject arbitrary web script or HTML via the 1 module parameter to admin.php or 2 op parameter to user.php. NOTE: the vendor reports that certain issues could not be reproduced for 760 RC3, or for .750...
