CVE-2006-6016

CVE-2006-6016 affects WordPress components prior to 2.0.5. A remote authenticated user can access the metadata of arbitrary users by modifying the user_id parameter on wp-admin/user-edit.php. The underlying issue exposes partial confidentiality and is triggered by insufficient access control for ...

CVE-2006-6016: Out-of-bounds Read

wp-admin/user-edit.php in WordPress before 2.0.5 allows remote authenticated users to read the metadata of an arbitrary user via a modified userid parameter...

[ECHO_ADV_55$2006]Phpmybibli <=2.1 Multiple Remote File Inclusion Vulnerability

ECHOADV55$2006 ------------------------------------------------------------------------ ----------------------- ECHOADV55$2006Phpmybibli =2.1 Multiple Remote File Inclusion Vulnerability ------------------------------------------------------------------------ ----------------------- Author : Dedi...

CVE-2006-5402: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in PHPmybibli 3.0.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the 1 classpath, 2 javascriptpath, and 3 includepath parameters in a cart.php; the 4 classpath parameter in b index.php; the 5 javascriptpath...

CVE-2006-4785: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in blog/edit.php in Moodle 1.6.1 and earlier allows remote attackers to execute arbitrary SQL commands via the format parameter as stored in the $blogEntry variable, which is not properly handled by the insertrecord function, which calls adodbcolumnsql in the adodb lay...

CVE-2006-4208

Directory traversal vulnerability in wp-db-backup.php in Skippy WP-DB-Backup plugin for WordPress 1.7 and earlier allows remote authenticated users with administrative privileges to read arbitrary files via a .. dot dot in the backup parameter to edit.php...

CVE-2006-3063

The CVE-2006-3063 entry describes multiple cross-site scripting (XSS) vulnerabilities in myPHP Guestbook 1.x through 2.0.0-r1 and prior to 2.0.1 RC5. The flaw allows remote attackers to inject arbitrary script or HTML via user-supplied content in specific parameters across multiple pages: (a) ind...

CVE-2006-3063: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in myPHP Guestbook 1.x through 2.0.0-r1 and before 2.0.1 RC5 allow remote attackers to inject arbitrary web script or HTML via the 1 comment, 2 email, 3 homepage, 4 id, 5 name, and 6 text parameters in a index.php, the 7 comment, 8 email, 9...

Default credentials

Dmx Forum 2.1a allows remote attackers to obtain username and password information via a direct request to pops/edit.php with a modified membre parameter...

CVE-2006-2947

Dmx Forum 2.1a allows remote attackers to obtain username and password information via a direct request to pops/edit.php with a modified membre parameter...

CVE-2006-2947: Undefined Security Weakness

Dmx Forum 2.1a allows remote attackers to obtain username and password information via a direct request to pops/edit.php with a modified membre parameter...

CVE-2006-2757

Cross-site scripting XSS vulnerability in Chipmunk guestbook allows remote attackers to inject arbitrary web script or HTML via the 1 start parameter in a index.php; 2 forumID parameter in index.php, b newtopic.php, and c reply.php; and 3 ID parameter to d edit.php...

Cross site scripting

Cross-site scripting XSS vulnerability in Chipmunk guestbook allows remote attackers to inject arbitrary web script or HTML via the 1 start parameter in a index.php; 2 forumID parameter in index.php, b newtopic.php, and c reply.php; and 3 ID parameter to d edit.php...

CVE-2006-2757

Cross-site scripting XSS vulnerability in Chipmunk guestbook allows remote attackers to inject arbitrary web script or HTML via the 1 start parameter in a index.php; 2 forumID parameter in index.php, b newtopic.php, and c reply.php; and 3 ID parameter to d edit.php...

CVE-2006-2757: Undefined Security Weakness

Cross-site scripting XSS vulnerability in Chipmunk guestbook allows remote attackers to inject arbitrary web script or HTML via the 1 start parameter in a index.php; 2 forumID parameter in index.php, b newtopic.php, and c reply.php; and 3 ID parameter to d edit.php...

Sql injection

SQL injection vulnerability in @1 File Store 2006.03.07 allows remote attackers to execute arbitrary SQL commands via the id parameter to 1 functions.php and 2 user.php in the libs directory, 3 edit.php and 4 delete.php in control/files/, 5 edit.php and 6 delete.php in control/users/, 7 edit.php,...

CVE-2006-0183: Undefined Security Weakness

Direct static code injection vulnerability in edit.php in ACal Calendar Project 2.2.5 allows authenticated users to execute arbitrary PHP code via 1 the edit=header value, which modifies header.php, or 2 the edit=footer value, which modifies footer.php. NOTE: this issue might be resultant from th...

CVE-2005-4225

Multiple "potential" SQL injection vulnerabilities in myBloggie 2.1.3 beta might allow remote attackers to execute arbitrary SQL commands via 1 the category parameter in add.php, 2 the catdesc parameter in addcat.php, 3 the level and user parameters in adduser.php, 4 the postid parameter in...

CVE-2005-4225: Undefined Security Weakness

Multiple "potential" SQL injection vulnerabilities in myBloggie 2.1.3 beta might allow remote attackers to execute arbitrary SQL commands via 1 the category parameter in add.php, 2 the catdesc parameter in addcat.php, 3 the level and user parameters in adduser.php, 4 the postid parameter in...

CVE-2005-4006: Improper Authentication

SAPID CMS before 1.2.3.03 allows remote attackers to bypass authentication via direct requests to the usr/system files 1 insertfile.php, 2 insertimage.php, 3 insertlink.php, 4 insertqcfile.php, and 5 edit.php...