CVE-2007-4893: Cross-Site Request Forgery (CSRF)

wp-admin/admin-functions.php in Wordpress before 2.2.3 and Wordpress multi-user MU before 1.2.5a does not properly verify the unfilteredhtml privilege, which allows remote attackers to conduct cross-site scripting XSS attacks via modified data to 1 post.php or 2 page.php with a nofilter field...

CVE-2007-3980: Undefined Security Weakness

PHP remote file inclusion vulnerability in page.php in RCMS Pro RGameScript Pro allows remote attackers to execute arbitrary PHP code via a URL in the id parameter...

RGameScript Pro (page.php id) Remote File Inclusion Vulnerability

No description provided by source. /////\ Web Application: RCMS-Pro ///// Info: ///////////////////////////////////////////////////// Vulnerability: Remote File Inclusion Vendor: http://www.rcms-pro.com/ Dork: "Powered by RGameScript" Found By: Warpboy E-Mail/MSNM: [email protected]...

RGameScript Pro - 'page.php?id' Remote File Inclusion

/////\ Web Application: RCMS-Pro ///// Info: ///////////////////////////////////////////////////// Vulnerability: Remote File Inclusion Vendor: http://www.rcms-pro.com/ Dork: "Powered by RGameScript" Found By: Warpboy E-Mail/MSNM: [email protected] Website: http://private-node.net Shouts:...

Sql injection

Multiple SQL injection vulnerabilities in eSyndiCat allow remote attackers to execute arbitrary SQL commands via 1 the id parameter to news.php or 2 the name parameter to page.php...

CVE-2007-3811: Undefined Security Weakness

Multiple SQL injection vulnerabilities in eSyndiCat allow remote attackers to execute arbitrary SQL commands via 1 the id parameter to news.php or 2 the name parameter to page.php...

igshop14-eval.txt

!/usr/bin/perl -w use LWP::UserAgent; iG Shop 1.4 eval Inclusion Vulnerability found by IFX nyubicrew Vulnerability on page.php if !$action $action = "make"; // here the function will be called. eval "page$action;"; die "Example: perl $0 http://www.planetgolfuk.co.uk/shop\n" unless @ARGV; $b =...

iG Shop 1.4 eval Inclusion Vulnerability

!/usr/bin/perl -w use LWP::UserAgent; iG Shop 1.4 eval Inclusion Vulnerability found by IFX nyubicrew Vulnerability on page.php if !$action $action = "make"; // here the function will be called. eval "page$action;"; die "Example: perl $0 http://www.planetgolfuk.co.uk/shopn" unless @ARGV; $b =...

CVE-2007-2717

SQL injection vulnerability in shop/page.php in iGeneric iG Shop 1.4 allows remote attackers to execute arbitrary SQL commands via the typeid parameter, a different vector than CVE-2005-0537...

iG Shop 1.4 - page.php SQL Injection

iG Shop 1.4 - page.php SQL Injection Discovered by: gsy & kerem125 Website: www.kerem125.com Script Download: http://www.igeneric.co.uk/ig-shopping-cart.html exploit:/shop/page.php?pagetype=catalognavigate&typeid=-99%20union//select//password//from//users/...

CVE-2007-2428: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in page.php in Ahhp-Portal allow remote attackers to execute arbitrary PHP code via a URL in the 1 fp or 2 sc parameter...

Directory traversal

Multiple directory traversal vulnerabilities in iXon CMS 0.30 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the themeurl parameter to 1 index.php, 2 page.php, 3 search.php, 4 single.php, and 5 archives.php...

CVE-2007-2104

CVE-2007-2104 affects iXon CMS 0.30. The vulnerability is a directory traversal in the theme_url parameter that allows remote attackers to include and execute arbitrary local files via a .. traversal in (1) index.php, (2) page.php, (3) search.php, (4) single.php, and (5) archives.php. Impact is d...

CVE-2007-2104

Multiple directory traversal vulnerabilities in iXon CMS 0.30 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the themeurl parameter to 1 index.php, 2 page.php, 3 search.php, 4 single.php, and 5 archives.php...

CVE-2007-0134

Multiple eval injection vulnerabilities in iGeneric iG Shop 1.0 allow remote attackers to execute arbitrary code via the action parameter, which is supplied to an eval function call in 1 cart.php and 2 page.php. NOTE: a later report and CVE analysis indicate that the vulnerability is present in 1...

CVE-2007-0134: Improper Control of Generation of Code

Multiple eval injection vulnerabilities in iGeneric iG Shop 1.0 allow remote attackers to execute arbitrary code via the action parameter, which is supplied to an eval function call in 1 cart.php and 2 page.php. NOTE: a later report and CVE analysis indicate that the vulnerability is present in 1...

CVE-2007-0093

SQL injection vulnerability in page.php in Simple Web Content Management System allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2007-0088: Undefined Security Weakness

Multiple directory traversal vulnerabilities in openmedia allow remote attackers to read arbitrary files via a .. dot dot in the 1 src parameter to page.php or the 2 format parameter to searchform.php...

CVE-2007-0093: Undefined Security Weakness

SQL injection vulnerability in page.php in Simple Web Content Management System allows remote attackers to execute arbitrary SQL commands via the id parameter...

Spaminator <= 1.7 (page) Remote File Include Vulnerability

No description provided by source. Spaminator 1.7. $page Remote File Include CreW: ToXiC BuG Found By Drago84 SourcE CodE: http://freshmeat.net/redir/spaminator/16281/urltgz/spaminator-1.7.tar.gz Page Affect is: /src/Login.php Problem is include "$page.php"; Path : Declare $page ExpL:...