Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in SunShop 3.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 prevaction, 2 previd, 3 prevstart, 4 itemid, 5 id, and 6 action parameters in index.php...

CVE-2006-2122

PHP remote file inclusion vulnerability in index.php in CoolMenus allows remote attackers to execute arbitrary code via a URL in the page parameter. NOTE: the original report for this issue is probably erroneous, since CoolMenus does not appear to be written in PHP...

CVE-2006-2122

CVE-2006-2122 describes a PHP remote file inclusion vulnerability in CoolMenus, where index.php is vulnerable to a URL-based page parameter that could allow remote code execution. The description notes that the original report may be erroneous because CoolMenus does not appear to be written in PH...

CVE-2006-2124

Multiple cross-site scripting XSS vulnerabilities in SunShop 3.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 prevaction, 2 previd, 3 prevstart, 4 itemid, 5 id, and 6 action parameters in index.php...

Pinnacle Cart XSS

Pinnacle Cart XSS Vuln. discovered by : r0t Date: 30 april 2006 vendorlink:http://www.pinnaclecart.com/ affected versions:3.33 and prior orginal advisory:http://pridels.blogspot.com/2006/04/pinnacle-cart-xss.html Vuln. Description: Pinnacle Cart contains a flaw that allows a remote cross site...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in FarsiNews 2.5.3 Pro and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 month and 2 year parameters in a index.php, and the 3 mod parameter in b admin.php...

CVE-2005-4792

SQL injection vulnerability in index.php in Appalachian State University phpWebSite 0.10.1 and earlier allows remote attackers to execute arbitrary SQL commands via the module parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

CVE-2006-2084

Multiple cross-site scripting XSS vulnerabilities in FarsiNews 2.5.3 Pro and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 month and 2 year parameters in a index.php, and the 3 mod parameter in b admin.php...

CVE-2005-4792

CVE-2005-4792 is a SQL injection in phpWebSite’s index.php (versions

CoolMenus.txt

Original Advisory : http://kurdishsecurity.blogspot.com/2006/04/coolmenus-event-remote-file-include.html ColMenus Event Remote File Include Vulnerability Website : http://coolmenus.dhtmlcentral.com/projects/coolmenus Closed Script : CoolMenus v4.0 Event Script Risk : High Class : Remote Greetz :...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in index.php in Edwin van Wijk phpWebFTP 2.3 allow remote attackers to inject arbitrary web script or HTML via the 1 port, 2 server, and 3 user parameters. NOTE: it is possible that the affected version is actually 3.2...

CVE-2006-2048

Multiple cross-site scripting XSS vulnerabilities in index.php in Edwin van Wijk phpWebFTP 2.3 allow remote attackers to inject arbitrary web script or HTML via the 1 port, 2 server, and 3 user parameters. NOTE: it is possible that the affected version is actually 3.2...

CVE-2006-2048

Multiple cross-site scripting XSS vulnerabilities in index.php in Edwin van Wijk phpWebFTP 2.3 allow remote attackers to inject arbitrary web script or HTML via the 1 port, 2 server, and 3 user parameters. NOTE: it is possible that the affected version is actually 3.2...

CVE-2006-2037

Cross-site scripting XSS vulnerability in index.php in Thwboard 3.0 Beta 2.84 allows remote attackers to inject arbitrary web script or HTML via the navpath parameter...

CVE-2006-2040

Photokorn versions 1.53 and 1.542 are affected by multiple SQL injection vulnerabilities that allow remote attackers to manipulate SQL via parameters in index.php (cat, pic, page), postcard.php (id), and print.php (cat). The NVD entry confirms remote code execution of arbitrary SQL commands with ...

CVE-2006-2037

Cross-site scripting XSS vulnerability in index.php in Thwboard 3.0 Beta 2.84 allows remote attackers to inject arbitrary web script or HTML via the navpath parameter...

CVE-2006-2037

CVE-2006-2037 describes a cross-site scripting (XSS) vulnerability in Thwboard 3.0 Beta 2.84, specifically in index.php where the navpath parameter can be exploited to inject arbitrary script/HTML. The vulnerability affects the index.php handling of navpath and is characterized as an XSS risk tha...

CVE-2006-2031

Cross-site scripting XSS vulnerability in index.php in phpMyAdmin 2.8.0.3, 2.8.0.2, 2.8.1-dev, and 2.9.0-dev allows remote attackers to inject arbitrary web script or HTML via the lang parameter...

CVE-2006-2031

CVE-2006-2031 (and related entries) documents a cross-site scripting (XSS) flaw in phpMyAdmin 2.8.0.x branches. The vulnerability allows injection of arbitrary script/HTML via the lang parameter (and related theme parameter references in other sources). Affected products include phpMyAdmin 2.8.0....

Sql injection

Eval injection vulnerability in index.php in ClanSys 1.1 allows remote attackers to execute arbitrary PHP code via PHP code in the page parameter, as demonstrated by using an "include" statement that is injected into the eval statement. NOTE: this issue has been described as file inclusion by som...