CVE-2010-2849: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in productionnu2/nuedit.php in nuBuilder 10.04.20, and possibly other versions before 10.07.12, allows remote attackers to inject arbitrary web script or HTML via the f parameter...

CVE-2009-4941: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in signin.php in ATRC ACollab 1.2 allows remote attackers to inject arbitrary web script or HTML via the f parameter...

CVE-2010-0989: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in delete.php in Pulse CMS before 1.2.3 allows remote authenticated users to delete arbitrary files via directory traversal sequences in the f parameter...

CVE-2010-1080: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in view.php in Pulse CMS 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the f parameter...

CVE-2010-0606: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in scp/ajax.php in osTicket before 1.6.0 Stable allows remote authenticated users to inject arbitrary web script or HTML via the f parameter, possibly related to an error message generated by scp/admin.php...

CVE-2010-0613: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in viewfile.php in ARWScripts Fonts Script allows remote attackers to read arbitrary local files via directory traversal sequences in a base64-encoded f parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third par...

CVE-2009-1853: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in index.php in Kensei Board 2.0 BETA aka 2.0.0b and earlier allow remote attackers to execute arbitrary SQL commands via the 1 f and 2 t parameters in a showforum action...

CVE-2008-5578: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in index.php in sCssBoard 1.0, 1.1, 1.11, and 1.12 allow remote attackers to execute arbitrary SQL commands via 1 the f parameter in a showforum action, 2 the u parameter in a profile action, 3 the viewcat parameter, or 4 a combination of scbuid and scbident...

CVE-2008-1636: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in JV2 Quick Gallery 1.1 allows remote attackers to inject arbitrary web script or HTML via the f parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-0232: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Zero CMS 1.0 Alpha allow remote attackers to execute arbitrary SQL commands via 1 the id parameter to index.php, or the 2 f or t parameters to forums/index.php...

CVE-2007-4895: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in dwoprn.php in Sisfo Kampus 2006 Semarang 3 allows remote attackers to read arbitrary files via the f parameter...

CVE-2007-3812: Undefined Security Weakness

SQL injection vulnerability in forums.php in CMScout 1.23 and earlier allows remote attackers to execute arbitrary SQL commands via the f parameter in a forums action to index.php...

CVE-2007-1125: Undefined Security Weakness

Cross-site scripting XSS vulnerability in gallery.php in XeroXer Simple one-file gallery allows remote attackers to inject arbitrary web script or HTML via the f parameter...

CVE-2006-6384: Undefined Security Weakness

Absolute path traversal vulnerability in abitwhizzy.php before 20061204 allows remote attackers to read arbitrary files via an absolute pathname in the Filename text window f parameter, a variant of CVE-2006-6084...

CVE-2006-3560: Undefined Security Weakness

SQL injection vulnerability in topics.php in Blue Dojo Graffiti Forums 1.0 allows remote attackers to execute arbitrary SQL commands via the f parameter...

CVE-2006-2425: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in PRV.php in PhpRemoteView, possibly 2003-10-23 and earlier, allow remote attackers to inject arbitrary web script or HTML via the 1 f, 2 d, and 3 ref parameters, and the 4 "MAKE DIR" and 5 "Full file name" fields...

CVE-2006-1070: Undefined Security Weakness

Cross-site scripting XSS vulnerability in dvgbook.php in DVguestbook 1.0 allows remote attackers to inject arbitrary web script or HTML via the f parameter...

CVE-2006-0873: Undefined Security Weakness

Absolute path traversal vulnerability in docs/showdocs.php in Coppermine Photo Gallery 1.4.3 and earlier allows remote attackers to include arbitrary files via the f parameter, and possibly remote files using UNC share pathnames...

PT-2005-5482 · Unknown · Land Down Under

Name of the Vulnerable Software and Affected Versions: Land Down Under LDU versions v801 and earlier Description: The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via parameters including 1 the m parameter in "auth.php", 2 the f parameter in "events.php", ...

CVE-2005-3513: Undefined Security Weakness

index.php in VUBB alpha rc1 allows remote attackers to obtain the installation path of the application via a viewforum action with the f parameter set to a single quote '...