Sql injection

SQL injection vulnerability in search.php in Pre Classifieds Listings 1.0 allows remote attackers to execute arbitrary SQL commands via the category parameter...

CVE-2007-2675

CVE-2007-2675 concerns a SQL injection in the file search.php of Pre Classifieds Listings 1.0 , where an attacker can supply the category parameter to execute arbitrary SQL. The vulnerability is exploitable remotely with network access and low authentication requirements, potentially impacting co...

Design/Logic Flaw

SonicBB 1.0 allows remote attackers to obtain sensitive information via the 1 by parameter to search.php, 2 p parameter to viewforum.php, and the 3 id parameter to a viewforum.php or b members.php, which reveal the installation path in the resulting error message...

Sql injection

Multiple SQL injection vulnerabilities in SonicBB 1.0 allow remote attackers to execute arbitrary SQL commands via the 1 part and 2 by parameters to a search.php, or the 2 id parameter to b viewforum.php...

CVE-2007-1903

SonicBB 1.0 is affected by CVE-2007-1903: a cross-site scripting (XSS) vulnerability in search.php via the part parameter. The issue allows remote attackers to inject arbitrary script/HTML; exploitation details indicate it can be triggered when PHP magic_quotes_gpc is Off. The advisory references...

CVE-2007-2675: Undefined Security Weakness

SQL injection vulnerability in search.php in Pre Classifieds Listings 1.0 allows remote attackers to execute arbitrary SQL commands via the category parameter...

CVE-2007-1902: Undefined Security Weakness

Multiple SQL injection vulnerabilities in SonicBB 1.0 allow remote attackers to execute arbitrary SQL commands via the 1 part and 2 by parameters to a search.php, or the 2 id parameter to b viewforum.php...

CVE-2007-1901: Undefined Security Weakness

SonicBB 1.0 allows remote attackers to obtain sensitive information via the 1 by parameter to search.php, 2 p parameter to viewforum.php, and the 3 id parameter to a viewforum.php or b members.php, which reveal the installation path in the resulting error message...

CVE-2007-1903: Undefined Security Weakness

Cross-site scripting XSS vulnerability in search.php in SonicBB 1.0 allows remote attackers to inject arbitrary web script or HTML via the part parameter...

Unfixed XSS vulnerability at www.invvio.com

Security researcher Uber0n, has submitted on 05/12/2007 a cross-site-scripting XSS vulnerability affecting www.invvio.com, which at the time of submission ranked 1344710 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 11/12/2007. It is currentl...

CVE-2007-2599

Multiple SQL injection vulnerabilities in TutorialCMS aka Photoshop Tutorials 1.00 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 catFile parameter to a browseCat.php or b browseSubCat.php; the 2 id parameter to c openTutorial.php, d topFrame.php, or e...

CVE-2007-2599

TutorialCMS (aka Photoshop Tutorials) 1.00 and earlier contains multiple SQL injection vulnerabilities. The affected components include (1) catFile parameter for browseCat.php and browseSubCat.php, (2) id parameter for openTutorial.php, topFrame.php, and admin/editListing.php, and (3) the search ...

CVE-2007-2600

Multiple cross-site scripting XSS vulnerabilities in TutorialCMS aka Photoshop Tutorials 1.00 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 catFile parameter to a browseCat.php or b browseSubCat.php; the 2 id parameter to c openTutorial.php, d topFrame.php, o...

Unfixed XSS vulnerability at www.searchtons.com

Security researcher RoMeO, has submitted on 05/11/2007 a cross-site-scripting XSS vulnerability affecting www.searchtons.com, which at the time of submission ranked 145218 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 06/11/2007. It is...

Unfixed XSS vulnerability at www.t7r.org

Security researcher St@rExT, has submitted on 25/04/2007 a cross-site-scripting XSS vulnerability affecting www.t7r.org, which at the time of submission ranked 1467659 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 25/04/2007. It is currently...

CVE-2007-2234: Undefined Security Weakness

include/common.php in PunBB 1.2.14 and earlier does not properly handle a disabled iniget function when checking the registerglobals setting, which allows remote attackers to register global parameters, as demonstrated by an SQL injection attack on the searchid parameter to search.php...

Directory traversal

Multiple directory traversal vulnerabilities in iXon CMS 0.30 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the themeurl parameter to 1 index.php, 2 page.php, 3 search.php, 4 single.php, and 5 archives.php...

CVE-2007-2104

CVE-2007-2104 affects iXon CMS 0.30. The vulnerability is a directory traversal in the theme_url parameter that allows remote attackers to include and execute arbitrary local files via a .. traversal in (1) index.php, (2) page.php, (3) search.php, (4) single.php, and (5) archives.php. Impact is d...

CVE-2007-2104

Multiple directory traversal vulnerabilities in iXon CMS 0.30 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the themeurl parameter to 1 index.php, 2 page.php, 3 search.php, 4 single.php, and 5 archives.php...

CVE-2007-2077: Undefined Security Weakness

PHP remote file inclusion vulnerability in search.php in Maian Search 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the pathtofolder parameter. NOTE: this issue was disputed by a third party researcher, but confirmed by the vendor, stating "this issue was fixed last year...