CVE-2006-2124

Multiple cross-site scripting XSS vulnerabilities in SunShop 3.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 prevaction, 2 previd, 3 prevstart, 4 itemid, 5 id, and 6 action parameters in index.php...

Pinnacle Cart XSS

Pinnacle Cart XSS Vuln. discovered by : r0t Date: 30 april 2006 vendorlink:http://www.pinnaclecart.com/ affected versions:3.33 and prior orginal advisory:http://pridels.blogspot.com/2006/04/pinnacle-cart-xss.html Vuln. Description: Pinnacle Cart contains a flaw that allows a remote cross site...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in FarsiNews 2.5.3 Pro and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 month and 2 year parameters in a index.php, and the 3 mod parameter in b admin.php...

CVE-2005-4792

SQL injection vulnerability in index.php in Appalachian State University phpWebSite 0.10.1 and earlier allows remote attackers to execute arbitrary SQL commands via the module parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

CVE-2005-4792

CVE-2005-4792 is a SQL injection in phpWebSite’s index.php (versions

CVE-2006-2084

Multiple cross-site scripting XSS vulnerabilities in FarsiNews 2.5.3 Pro and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 month and 2 year parameters in a index.php, and the 3 mod parameter in b admin.php...

CoolMenus.txt

Original Advisory : http://kurdishsecurity.blogspot.com/2006/04/coolmenus-event-remote-file-include.html ColMenus Event Remote File Include Vulnerability Website : http://coolmenus.dhtmlcentral.com/projects/coolmenus Closed Script : CoolMenus v4.0 Event Script Risk : High Class : Remote Greetz :...

CVE-2006-2048

Multiple cross-site scripting XSS vulnerabilities in index.php in Edwin van Wijk phpWebFTP 2.3 allow remote attackers to inject arbitrary web script or HTML via the 1 port, 2 server, and 3 user parameters. NOTE: it is possible that the affected version is actually 3.2...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in index.php in Edwin van Wijk phpWebFTP 2.3 allow remote attackers to inject arbitrary web script or HTML via the 1 port, 2 server, and 3 user parameters. NOTE: it is possible that the affected version is actually 3.2...

CVE-2006-2048

Multiple cross-site scripting XSS vulnerabilities in index.php in Edwin van Wijk phpWebFTP 2.3 allow remote attackers to inject arbitrary web script or HTML via the 1 port, 2 server, and 3 user parameters. NOTE: it is possible that the affected version is actually 3.2...

CVE-2006-2037

Cross-site scripting XSS vulnerability in index.php in Thwboard 3.0 Beta 2.84 allows remote attackers to inject arbitrary web script or HTML via the navpath parameter...

CVE-2006-2037

Cross-site scripting XSS vulnerability in index.php in Thwboard 3.0 Beta 2.84 allows remote attackers to inject arbitrary web script or HTML via the navpath parameter...

CVE-2006-2040

Photokorn versions 1.53 and 1.542 are affected by multiple SQL injection vulnerabilities that allow remote attackers to manipulate SQL via parameters in index.php (cat, pic, page), postcard.php (id), and print.php (cat). The NVD entry confirms remote code execution of arbitrary SQL commands with ...

CVE-2006-2037

CVE-2006-2037 describes a cross-site scripting (XSS) vulnerability in Thwboard 3.0 Beta 2.84, specifically in index.php where the navpath parameter can be exploited to inject arbitrary script/HTML. The vulnerability affects the index.php handling of navpath and is characterized as an XSS risk tha...

CVE-2006-2031

Cross-site scripting XSS vulnerability in index.php in phpMyAdmin 2.8.0.3, 2.8.0.2, 2.8.1-dev, and 2.9.0-dev allows remote attackers to inject arbitrary web script or HTML via the lang parameter...

CVE-2006-2031

CVE-2006-2031 (and related entries) documents a cross-site scripting (XSS) flaw in phpMyAdmin 2.8.0.x branches. The vulnerability allows injection of arbitrary script/HTML via the lang parameter (and related theme parameter references in other sources). Affected products include phpMyAdmin 2.8.0....

Sql injection

Eval injection vulnerability in index.php in ClanSys 1.1 allows remote attackers to execute arbitrary PHP code via PHP code in the page parameter, as demonstrated by using an "include" statement that is injected into the eval statement. NOTE: this issue has been described as file inclusion by som...

CVE-2006-2001

CVE-2006-2001 affects Scry Gallery 1.1, with a cross-site scripting (XSS) flaw in index.php exploitable via the p parameter. The vulnerability’s CVSS v2 vector (AV:N/AC:M/Au:N/C:N/I:P/A:N) yields a base score of 4.3 (Medium). Impact is limited to partial integrity risk; confidentiality and availa...

CVE-2006-1995

CVE-2006-1995 affects Scry Gallery 1.1. The vulnerability is a directory traversal in index.php, exploitable via the p parameter containing .. sequences. The root cause is improper sanitization due to an rtrim function call with arguments in the wrong order. Documents provided do not include spec...

[Full-disclosure] Advisory: Clansys <= 1.1 PHP Code Insertion Vulnerability.

--Security Report-- Advisory: Clansys = 1.1 PHP Code Insertion Vulnerability. --- Author: Mustafa Can Bjorn "nukedx a.k.a nuker" IPEKCI --- Date: 23/04/06 21:07 PM --- Contacts: ICQ: 10072 MSN/Email: [email protected] Web: http://www.nukedx.com --- Vendor: Clansys http://www.clansys.de.vu/ Versio...