CVE-2008-7003: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in login.php in The Rat CMS Alpha 2 allow remote attackers to execute arbitrary SQL commands via the 1 userid and 2 password parameter...

CVE-2009-2780

Multiple cross-site scripting XSS vulnerabilities in 68 Classifieds 4.1 allow remote attackers to inject arbitrary web script or HTML via the 1 cat parameter to category.php, view parameter to 2 login.php and 3 viewlisting.php, page parameter to 4 searchresults.php and 5 toplistings.php, and 6...

CVE-2009-2780: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in 68 Classifieds 4.1 allow remote attackers to inject arbitrary web script or HTML via the 1 cat parameter to category.php, view parameter to 2 login.php and 3 viewlisting.php, page parameter to 4 searchresults.php and 5 toplistings.php, and 6...

CVE-2009-2762

CVE-2009-2762 affects WordPress ≤ 2.8.3. The vulnerability allows remote attackers to trigger a password reset for the first user (potentially admin) by supplying a key[] array to the resetpass (rp) action, bypassing the check that key is not an array. This is a network‑level exploit with a CVSSv...

CVE-2009-2762

wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for the first user in the database, possibly the administrator, via a key array variable in a resetpass aka rp action, which bypasses a check that assumes that $key is not an array...

CVE-2009-2762: Undefined Security Weakness

wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for the first user in the database, possibly the administrator, via a key array variable in a resetpass aka rp action, which bypasses a check that assumes that $key is not an array...

WordPress < 2.8.4 'wp-login.php' 'key' Parameter Remote Administrator Password Reset (uncredentialed check)

According to its version number, the version of WordPress running on the remote server has a flaw in the password reset mechanism. Validation of the secret user activation key can be bypassed by providing an array instead of a string. This allows anyone to reset the password of the first user in...

Path traversal

login.php in 3CX Phone System 6.0.806.0, when 100% disk capacity is reached, allows remote attackers to gain sensitive information via unspecified vectors that reveal the installation path...

CVE-2008-6896

login.php in 3CX Phone System 6.0.806.0, when 100% disk capacity is reached, allows remote attackers to gain sensitive information via unspecified vectors that reveal the installation path...

CVE-2008-6896

CVE-2008-6896 affects the 3CX Phone System (version 6.0.806.0). When disk usage reaches 100%, remote attackers can obtain sensitive information that reveals the installation path through unspecified vectors. The exact root cause is not detailed in the provided documents. Impact is described as pa...

CVE-2008-6896

login.php in 3CX Phone System 6.0.806.0, when 100% disk capacity is reached, allows remote attackers to gain sensitive information via unspecified vectors that reveal the installation path...

Blink Blog System Authentication Bypass

Salvatore "drosophila" Fresta + Application: Blink Blog System + Version: Unknown + Website: http://blogink.sourceforge.net + Bugs: A Authentication Bypass + Exploitation: Remote + Date: 03 Aug 2009 + Discovered by: Salvatore Fresta aka drosophila + Author: Salvatore Fresta aka drosophila + E-mai...

CVE-2008-6894: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in login.php in 3CX Phone System Free Edition 6.1793 and 6.0.806.0 allow remote attackers to inject arbitrary web script or HTML via the 1 fName and 2 fPassword parameters...

CVE-2008-6896: Exposure of Sensitive Information to an Unauthorized Actor

login.php in 3CX Phone System 6.0.806.0, when 100% disk capacity is reached, allows remote attackers to gain sensitive information via unspecified vectors that reveal the installation path...

Allomani Mobile 2.5 Remote Blind SQL Injection Exploit

No description provided by source. ?php iniset"maxexecutiontime",0; printr' || || | || o,7 || . o7 || q||| o///, : / / . /QQQQQQQQQQQQQQQQQQQ\ q Allomani Mobile v2.5 /QQQ/\QQQ\ Blind SQL inj. exploit /QQQQQ/ \QQQQQQ\ q GET 3 /QQQQ/ QQQQ\ /QQQQ/ \QQQQ\ q http://allomani.com |QQQQ/ By Qabandi \QQQQ...

Allomani Mobile 2.5 - Blind SQL Injection

Allomani Mobile 2.5 - Blind SQL Injection ?php iniset"maxexecutiontime",0; printr' || || | || o,7 || . o7 || q||| o///, : / / . /QQQQQQQQQQQQQQQQQQQ\ q Allomani Mobile v2.5 /QQQ/\QQQ\ Blind SQL inj. exploit /QQQQQ/ \QQQQQQ\ q GET 3 /QQQQ/ QQQQ\ /QQQQ/ \QQQQ\ q http://allomani.com |QQQQ/ By Qaband...

CVE-2008-6876

CVE-2008-6876 is an XSS vulnerability in EsPartenaires 1.0, where the login.php page accepts a crafted msg parameter to inject script/HTML. Multiple related records (CVE-2008-2037) cover the EsContacts 1.0 issue; the shared vector is the msg parameter in login.php across EditeurScripts EsBaseAdmi...

CVE-2008-6876

Cross-site scripting XSS vulnerability in login.php in EsPartenaires 1.0 allows remote attackers to inject arbitrary web script or HTML via the msg parameter. NOTE: the EsContacts 1.0 issue is covered in CVE-2008-2037...

CVE-2008-6876: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in login.php in EsPartenaires 1.0 allows remote attackers to inject arbitrary web script or HTML via the msg parameter. NOTE: the EsContacts 1.0 issue is covered in CVE-2008-2037...

CVE-2008-6868: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in default/login.php in EditeurScripts EsBaseAdmin 2.1 allows remote attackers to inject arbitrary web script or HTML via the msg parameter. NOTE: the EsContacts 1.0 issue is covered in CVE-2008-2037...