CVE-2006-6248

GPhotos 1.5 contains a vulnerability in index.php where the invalid rep parameter can trigger an error message that reveals the full filesystem path. This CVE (CVE-2006-6248) is documented with a remote information disclosure impact (confidentiality) and a network attack vector, but no concrete r...

CVE-2006-6232

CVE-2006-6232 describes a PHP remote file inclusion vulnerability in DreamAccount 3.1, affecting admin/index.php via a URL in the path parameter. The underlying issue is a RFI in the path handling, allowing an attacker to execute arbitrary PHP code on the server. Documented impact is partial conf...

CVE-2006-6218

Multiple SQL injection vulnerabilities in index.php in dev4u CMS allow remote attackers to execute arbitrary SQL commands via the 1 seiteid, 2 gruppeid.php, and 3 gotarget parameters...

CVE-2006-6218

CVE-2006-6218 relates to dev4u CMS, where index.php is vulnerable to SQL injection via the (1) seite_id, (2) gruppe_id.php, and (3) go_target parameters. The root cause is improper handling/sanitization of input used in SQL queries, allowing remote attackers to alter the intended query and execut...

CVE-2006-6219

dev4u CMS is affected by multiple cross-site scripting (XSS) flaws in index.php, exploitable via the parameters (1) user_name, (2) passwort, and (3) go_target. The issue allows remote attackers to inject arbitrary web script or HTML. CVSSv2 base score is 6.8 (MEDIUM), with NETWORK attack vector, ...

Invision Gallery 2.0.7 SQL Injection Vulnerability

Invision Gallery 2.0.7 DOS attak can be performed index.php?automodule=gallery&cmd=postcomment&op=doaddcomment&Post=test&img=111 OR id IN SELECT BENCHMARK10000000,BENCHMARK10000000,md5currentdate FROM ipbgalleryimages...

snif <= 1.5.2 (index.php) Remote File Inclusion Vulnerability

No description provided by source. snif simple and nice index file Remote File Include Vulnerability Download Site: http://www.bitfolge.de/download/snif152.zip Found & Exploiting By: S.W.A.T. advistory: wWw.Xmors.CoM - wWw.XmorS.NeT POC:...

Wordpress Index.PHP跨站脚本漏洞

Wordpress是一款基于php的WEB应用程序。 Wordpress不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行跨站脚本获得敏感信息。 问题是由于'Index.PHP'脚本对用户提交的's'参数缺少过滤，提交恶意脚本代码作为参数数据，并诱使用户打开，可导致恶意脚本在目标浏览器上执行，可获得敏感信息。 WordPress WordPress 1.5 升级到Wordpress 2.0.6版本： http://wordpress.org/ http://www.example.com/wp-admin/edit.php?s=XSS&submit=Search...

CVE-2006-6157

ContentNow is affected by an SQL injection in index.php (v1.39 and earlier) that allows remote attackers to inject arbitrary SQL via the pageid parameter. The underlying issue can also expose path information when a non-existent/invalid pageid is provided. Affected product: ContentNow up to versi...

Sisfo Kampus 0.8 - Remote File Inclusion / Download

Source Code = Sisfokampus 0.8 Website = www.Sisfokampus.net Author = E. Setio Dewo [email protected] Dorkz : Allinurl: /index.php?exec= File Vuln : index.php print.php download.php Local File Include Found by : Wawan Firmansyah a.k.a Ang|n [email protected] Source of index.php...

CVE-2006-6069

index.php in mAlbum 0.3 and earlier allows remote attackers to obtain the installation path via an invalid gal parameter...

CVE-2006-6069

CVE-2006-6069 affects mAlbum 0.3 and earlier; index.php is vulnerable to an invalid gal parameter, enabling remote attackers to obtain the installation path. The CVSS2 base score is 5.0 (NETWORK vector, low attack complexity, no authentication, partial confidentiality impact). No remediation deta...

CVE-2006-6069

index.php in mAlbum 0.3 and earlier allows remote attackers to obtain the installation path via an invalid gal parameter...

CVE-2006-6037

Multiple cross-site scripting XSS vulnerabilities in index.php in Dan Jensen Travelsized CMS 0.4.1 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 page, 2 pageid, or 3 language parameter...

CVE-2006-6037

The CVE-2006-6037 entry describes multiple XSS vulnerabilities in Dan Jensen Travelsized CMS 0.4.1 and earlier, exploitable via index.php parameters (page, page_id, language). The underlying issue is reflected in the provided description; no exploitation details or exact root cause are given beyo...

CVE-2006-6032

SPHPBlog (Simple PHP Blog) is affected by XSS in CVE-2006-6032. Concrete details from the connected data show vulnerable code paths in SPHPBlog where input is used without proper validation for two parameters: the action parameter in add_block.php and the entry parameter in index.php. The descrip...

sphpblog08-rfi.txt

""""""""""""""""""""""""""""""""""""""""""""""" """ :: :: ::::: :::: """ """ :: :: :: : :: """ """ :::: :: :: ::::: ::::: :::: """ """ :: :: ::: ::: :: :: :: :: :: """ """ :: :: :: : : ::::: :: :: :::: """ """ """ """"""""""""""""""""""""""""""""""""""""""""""" Xmor$ DigitaL Hacking TeaM Sphpblog...

sphpblog08.txt

""""""""""""""""""""""""""""""""""""""""""""""" """ :: :: ::::: :::: """ """ :: :: :: : :: """ """ :::: :: :: ::::: ::::: :::: """ """ :: :: ::: ::: :: :: :: :: :: """ """ :: :: :: : : ::::: :: :: :::: """ """ """ """"""""""""""""""""""""""""""""""""""""""""""" Xmor$ DigitaL Hacking TeaM Sphpblog...

CVE-2006-5935

SQL injection vulnerability in index.php in ShopSystems 4.0 and earlier allows remote attackers to execute arbitrary SQL commands via the sessid parameter...

TorrentFlux 2.2 Arbitrary File Creation/Overwrite/Deletion & Command Execution Vulnerablities

r0ut3r Presents... Another r0ut3r discovery! TorrentFlux 2.2 Arbitrary File Creation/Overwrite/Deletion & Command Execution Vulnerablities Software: TorrentFlux 2.2 Vendor: http://www.torrentflux.com/ Released: 2006/11/15...