Remote Code Execution in artmedic Newsletter 4.1 [log.php]

I found a bug in artmedic Newsletter 4.1 proably even in newer versions which lets an attacker run arbitrary php-code and bypass the password protection. The reason for this is mistake in design. log.php: ?php $time = time; $date = date"d.m.Y, H:i:s"; $remote = getenv"REMOTEADDR"; $ip =...

CVE-2004-2028

CVE-2004-2028 describes a cross-site scripting (XSS) vulnerability in the PHP component used by the e107 CMS, specifically in the stats.php module. The flaw allows remote attackers to inject arbitrary web script or HTML by manipulating the referer parameter sent to log.php. Affected software is e...

CVE-2004-2028: Undefined Security Weakness

Cross-site scripting XSS vulnerability in stats.php in e107 allows remote attackers to inject arbitrary web script or HTML via the referer parameter to log.php...

CVE-2004-2028

Cross-site scripting XSS vulnerability in stats.php in e107 allows remote attackers to inject arbitrary web script or HTML via the referer parameter to log.php...

e107 Website System 0.50.6 - Log.php HTML Injection

e107 Website System 0.50.6 - Log.php HTML Injection source: https://www.securityfocus.com/bid/10395/info It is reported that e107 website system is prone to a remote HTML injection vulnerability. This issue is due to a failure by the application to properly sanitize user-supplied input. The probl...