CVE-2007-2262: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in html/php/detail.php in Sinato jmuffin allow remote attackers to execute arbitrary PHP code via a URL in the 1 relPath and 2 folder parameters. NOTE: this product was originally reported as "File117"...

file117-rfi.txt

File117 Remote File Inclusion Affected Software .: File117 Download..: http://www.sinato.com/jmuffin/upload/file117.zip Risk ..............: high Found by ..........: InyeXion Contact ...........: InyeXionatgmail.com Web .............: Www.InyeXion.com.ar Affected File: /html/php/detail.php...

Sql injection

SQL injection vulnerability in Grayscale Blog 0.8.0, and possibly earlier versions, might allow remote attackers to execute arbitrary SQL commands via the 1 id parameter to a userdetail.php, id and 2 url parameter to b jump.php, and id variable to c detail.php...

Cross site scripting

Cross-site scripting XSS vulnerability in Grayscale Blog 0.8.0, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via the comment fields to 1 scripts/addblogcomment.php and 2 detail.php...

CVE-2007-1433: Undefined Security Weakness

Cross-site scripting XSS vulnerability in Grayscale Blog 0.8.0, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via the comment fields to 1 scripts/addblogcomment.php and 2 detail.php...

CVE-2007-1434: Undefined Security Weakness

SQL injection vulnerability in Grayscale Blog 0.8.0, and possibly earlier versions, might allow remote attackers to execute arbitrary SQL commands via the 1 id parameter to a userdetail.php, id and 2 url parameter to b jump.php, and id variable to c detail.php...

CVE-2006-5828

CVE-2006-5828 affects DeltaScripts PHP Classifieds before the 7.2/7.1 release: the vulnerable file is detail.php, where the user_id parameter is used in an SQL query, enabling remote attackers to execute arbitrary SQL commands. The entry explicitly notes a SQL injection vulnerability in DeltaScri...

CVE-2006-5828: Undefined Security Weakness

SQL injection vulnerability in detail.php in DeltaScripts PHP Classifieds 7.1 and earlier allows remote attackers to execute arbitrary SQL commands via the userid parameter...

PHP Classifieds 7.1 - 'detail.php' SQL Injection

!/usr/bin/perl Script Name: Php Classifieds newProto = "tcp", PeerAddr = "$classifiedsserver", PeerPort = "$classifiedsport" || die "\n+ Connection failed...\n"; print $classifieds "...

PHP Classifieds <= 7.1 (detail.php) Remote SQL Injection Exploit

Exploit for unknown platform in category web applications ================================================================ PHP Classifieds = 7.1 detail.php Remote SQL Injection Exploit ================================================================ !/usr/bin/perl Script Name: Php Classifieds = 7...

CVE-2006-5127: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Bartels Schoene ConPresso before 4.0.5a allow remote attackers to inject arbitrary web script or HTML via 1 the nr parameter in detail.php, 2 the msg parameter in dbmysql.inc.php, and 3 the pos parameter in index.php...

CVE-2006-4863: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Marc Cagninacci mcLinksCounter 1.1 allow remote attackers to execute arbitrary PHP code via a URL in the langfile parameter in 1 login.php, 2 stats.php, 3 detail.php, or 4 erase.php. NOTE: CVE and a third party dispute this vulnerability,...

CVE-2006-3050: Undefined Security Weakness

Directory traversal vulnerability in detail.php in SixCMS 6.0, and other versions before 6.0.6patch2, allows remote attackers to read arbitrary files via a .. dot dot sequence and trailing null %00 byte in the template parameter...

CVE-2006-2669: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Pre Shopping Mall 1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 search parameter in search.php the "search box", 2 the prodid parameter in detail.php, and the 3 cid parameter in products.php...

CVE-2006-0087: Undefined Security Weakness

SQL injection vulnerability in 1 pages.php and 2 detail.php in Lizard Cart CMS 1.04 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2005-3308

Multiple cross-site scripting XSS vulnerabilities in Zomplog 3.4 allow remote attackers to inject arbitrary web script or HTML via the 1 name or 2 comment parameter in detail.php, 3 the username parameter in get.php, and 4 the search parameter in index.php...

CVE-2005-3309: Undefined Security Weakness

Multiple SQL injection vulnerabilities in Zomplog 3.4 allow remote attackers to execute arbitrary SQL commands via 1 the id parameter in detail.php and the catid parameter in 2 get.php and 3 index.php...

CVE-2005-3308: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Zomplog 3.4 allow remote attackers to inject arbitrary web script or HTML via the 1 name or 2 comment parameter in detail.php, 3 the username parameter in get.php, and 4 the search parameter in index.php...

CVE-2005-2430

Multiple cross-site scripting XSS vulnerabilities in GForge 4.5 allow remote attackers to inject arbitrary web script or HTML via the 1 forumid or 2 groupid parameter to forum.php, 3 projecttaskid parameter to task.php, 4 id parameter to detail.php, 5 the text field on the search page, 6 groupid...

CVE-2005-2430: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in GForge 4.5 allow remote attackers to inject arbitrary web script or HTML via the 1 forumid or 2 groupid parameter to forum.php, 3 projecttaskid parameter to task.php, 4 id parameter to detail.php, 5 the text field on the search page, 6 groupid...