Directory traversal

Directory traversal vulnerability in index.php in Noah Medling RCBlog 1.03 allows remote attackers to read arbitrary .txt files, possibly including one that stores the administrator's account name and password, via a .. dot dot in the post parameter...

CVE-2006-0371

CVE-2006-0371 concerns RCBlog 1.03 (PHP) where index.php accepts a post parameter that is not properly sanitized, enabling a directory traversal attack. An attacker can use a .. in the post parameter to read arbitrary .txt files on the remote host, potentially exposing sensitive data such as the ...

CVE-2006-0333

Cross-site scripting XSS vulnerability in ar-blog 5.2 allows remote attackers to inject arbitrary web script or HTML via the 1 month or 2 year parameter to index.php...

Cross site scripting

Cross-site scripting XSS vulnerability in ar-blog 5.2 allows remote attackers to inject arbitrary web script or HTML via the 1 month or 2 year parameter to index.php...

CVE-2006-0333

CVE-2006-0333: An XSS vulnerability in ar-blog 5.2 affects index.php, exploitable via the month or year parameters. Related entry CVE-2006-2809 expands the risk to additional parameters (count, next, Year_the_news, mo); note that the month/year vectors are already covered by CVE-2006-0333. No exp...

CVE-2006-0313

Multiple SQL injection vulnerabilities in PDFdirectory before 1.0 allow remote attackers to execute arbitrary SQL commands via multiple unspecified vectors involving 1 util.php, 2 userpref.php, 3 user.php, 4 uploadfrm.php, 5 title.php, 6 team.php, 7 stats.php, 8 page.php, 9 org.php, 10 member.php...

CVE-2006-0245

Multiple cross-site scripting XSS vulnerabilities in CubeCart 3.0.7-pl1 allow remote attackers to inject arbitrary web script or HTML via the 3 redir, 4 productId, 5 docId, 6 act, and 7 catId parameters in index.php; and the 8 username field in a login action in index.php. NOTE: the cart.php/redi...

CVE-2006-0237

Cross-site scripting XSS vulnerability in index.php in GTP iCommerce allows remote attackers to inject arbitrary web script or HTML via the 1 cat and 2 subcat parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Cross site scripting

Cross-site scripting XSS vulnerability in index.php in GTP iCommerce allows remote attackers to inject arbitrary web script or HTML via the 1 cat and 2 subcat parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2006-0242

CVE-2006-0242 corresponds to a Cross-site scripting vulnerability in PHP Fusebox 4.0.6, affecting index.php where the fuseaction parameter can be used to inject arbitrary web script or HTML. The vulnerability is triggered remotely via the fuseaction parameter, enabling partial confidentiality and...

CVE-2006-0237

CVE-2006-0237 concerns a cross-site scripting (XSS) vulnerability in index.php of GTP iCommerce. The flaw allows remote attackers to inject arbitrary web script or HTML via the (1) cat and (2) subcat parameters due to inadequate input handling. They can influence the content rendered in a victim’...

Sql injection

SQL injection vulnerability in index.php in microBlog 2.0 RC-10 allows remote attackers to execute arbitrary SQL commands via the 1 month and 2 year parameters...

CVE-2006-0234

CVE-2006-0234 documents a SQL injection vulnerability in the web application component: index.php of the microBlog 2.0 RC-10 release. The underlying issue is an injection flaw that allows remote attackers to append arbitrary SQL commands via the two parameters, (1) month and (2) year. The vulnera...

CVE-2005-4656

SQL injection vulnerability in index.php in TClanPortal 1.1.3 and earlier allows remote attackers to execute arbitrary SQL commands, and retrieve all usernames and passwords, via the id parameter...

[Full-disclosure] EZDatabase Directory Transversal, XSS and Path Disclosure Vulnerability

Synopsis: EZDatabase directory transversal, XSS and path disclosure vulnerability Product: EZDatabase http://www.ezdatabase.org Version: Confirmed on EZDatabase 2.1.2 Author: Josh Zlatin-Amishav Date: January 15, 2006 Background: Written in PHP and MySQL, ezDatabase is the foundation for your...

CVE-2005-4651

SQL injection vulnerability in index.php in AlstraSoft EPay Pro 2.0 allows remote attackers to execute arbitrary SQL commands via the pmodule parameter...

CVE-2006-0210

CVE-2006-0210 is a Cross-site Scripting (XSS) vulnerability in Interspire TrackPoint NX prior to 0.1. The issue occurs in index.php and allows remote attackers to inject arbitrary web script or HTML via the username parameter on the Login page. This is the concrete vulnerability described in the ...

CVE-2006-0204

Multiple cross-site scripting XSS vulnerabilities in Wordcircle 2.17 allow remote attackers to inject arbitrary web script or HTML via 1 the "Course name" field in index.php when the frm parameter has the value "mine" and 2 possibly certain other fields in unspecified scripts...

CVE-2006-0205

Multiple SQL injection vulnerabilities in Wordcircle 2.17 allow remote attackers to 1 execute arbitrary SQL commands and bypass authentication via the password field in the login action to index.php involving vlogin.php and suser.php and 2 have other unknown impact via certain other fields in...

CVE-2006-0205

Multiple SQL injection vulnerabilities in Wordcircle 2.17 allow remote attackers to 1 execute arbitrary SQL commands and bypass authentication via the password field in the login action to index.php involving vlogin.php and suser.php and 2 have other unknown impact via certain other fields in...