CVE-2006-1809

index.php in Lifetype 1.0.3 allows remote attackers to obtain sensitive information via an invalid show parameter, which reveals the path in an error message...

CVE-2006-1807

Multiple SQL injection vulnerabilities in index.php in Musicbox 2.3.3 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 start parameter in a search action or 2 type parameter in a top action...

CVE-2006-1825

Cross-site scripting XSS vulnerability in index.php in phpLinks 2.1.3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the term parameter...

CVE-2006-1807

CVE-2006-1807 affects MusicBox (older releases) where the PHP file index.php is vulnerable to SQL injection. The vulnerability allows remote attackers to inject arbitrary SQL via the (1) start parameter in a search action or (2) type parameter in a top action, in MusicBox 2.3.3 and earlier. Conne...

CVE-2006-1808

The CVE-2006-1808 entry describes a Cross-site Scripting (XSS) vulnerability in Lifetype 1.0.3, exploitable via the show parameter in a Template operation of index.php. The vulnerability allows remote attackers to inject arbitrary web script or HTML. Affected product: Lifetype 1.0.3. Root cause/s...

CVE-2006-1802

The CVE-2006-1802 issue affects TinyWebGallery 1.3 and 1.4, with a Cross-Site Scripting (XSS) flaw in index.php via the twg_album parameter. Remote attackers could inject arbitrary script/HTML. Root cause: unsanitized input in the twg_album parameter. No explicit remediation details are provided ...

phpwebftp -- "language" Local File Inclusion

Secunia reports: phpWebFTP have a vulnerability, which can be exploited by malicious people to disclose sensitive information. Input passed to the "language" parameter in index.php isn't properly verified, before it is used to include files. This can be exploited to include arbitrary files from...

AnimeGenesis <= XSS

==================== Discovered by: Qex Date: 17 April 2006 ==================== index.php?cat=XSS...

phpLinks <= 2.1.3.1 XSS vuln.

phpLinks = 2.1.3.1 XSS vuln. Vuln. discovered by : r0t Date: 16 april 2006 vendorlink:http://sourceforge.net/projects/phplinks/ affected versions:phpLinks 2.1.3.1 and previous orginal advisory: http://pridels.blogspot.com/2006/04/phplinks-2131-xss-vuln.html Vuln. Description: phpLinks contains a...

phpWebFTP index.php language Parameter Local File Inclusion

The remote host is running phpWebFTP, a web-based FTP client written in PHP. The version of phpWebFTP installed on the remote host fails to sanitize user-supplied input to the 'language' parameter of the 'index.php' script before using it in a PHP 'include' function. An unauthenticated attacker m...

Coppermine Photo Gallery index.php file Parameter Local File Inclusion

The version of Coppermine Gallery installed on the remote host fails to properly sanitize input to the 'file' parameter of the 'index.php' script before using it in a PHP 'includeonce' function. Regardless of PHP's 'registerglobals' setting, an unauthenticated attacker may be able to exploit this...

phpList index.php database_module Parameter Local File Inclusion

The version of phpList installed on the remote host fails to sanitize user-supplied input to the 'databasemodule' parameter of the 'lists/index.php' script before using it in a PHP 'requireonce' function. Provided PHP's 'registerglobals' setting is enabled, an unauthenticated attacker may be able...

phpWebSite <= 0.10.2 (hub_dir) Remote Commands Execution Exploit

No description provided by source. !/usr/bin/php -q -d shortopentag=on ? echo "PHPWebSite = 0.10.2 remote cmmnds xctn\r\n"; echo "- arbitrary local inclusion, works with magicquotesgpc = Off\r\n"; echo "by rgod, mail: [email protected]\r\n"; echo "site: http://retrogod.altervista.org\r\n\r\n"; i...

Sql injection

Multiple SQL injection vulnerabilities in Papoo 2.1.5, and 3 beta1 and earlier, allow remote attackers to execute arbitrary SQL commands via the 1 getlang and 2 reporeid parameter in a index.php, 3 menuid parameter in b plugin.php and c forumthread.php, and 4 msgid parameter in forumthread.php...

CVE-2006-1765

Cross-site scripting XSS vulnerability in index.php in JBook 1.3 allows remote attackers to inject arbitrary web script or HTML via the page parameter...

CVE-2006-1766

Multiple SQL injection vulnerabilities in Papoo 2.1.5, and 3 beta1 and earlier, allow remote attackers to execute arbitrary SQL commands via the 1 getlang and 2 reporeid parameter in a index.php, 3 menuid parameter in b plugin.php and c forumthread.php, and 4 msgid parameter in forumthread.php...

CVE-2006-1765

Cross-site scripting XSS vulnerability in index.php in JBook 1.3 allows remote attackers to inject arbitrary web script or HTML via the page parameter...

Sql injection

Multiple SQL injection vulnerabilities in index.php in blur6ex 0.3.452 allows remote attackers to execute arbitrary SQL commands via the ID parameter in a 1 greply or 2 gpermaPost action to the blog shard engine/shards/blog.php, or a 3 gviewContent action to the content shard...

Sql injection

SQL injection vulnerability in index.php in Vegadns 0.99 allows remote attackers to execute arbitrary SQL commands via the cid parameter...

Cross site scripting

Cross-site scripting vulnerability in index.php in blur6ex 0.3.452 allows remote attackers to inject arbitrary web script or HTML via the errormsg parameter, which is not sanitized in the error message. NOTE: the vector in the shard parameter is not XSS and has been assigned a separate name...