CVE-2007-4166: Undefined Security Weakness

Cross-site scripting XSS vulnerability in index.php in the Unnamed theme 1.217, and Special Edition SE 1.02, before 20070804 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter, possibly a related issue to CVE-2007-2757, CVE-2007-4014, and CVE-2007-416...

CVE-2007-4014: Undefined Security Weakness

Cross-site scripting XSS vulnerability in a certain index.php installation script related to the 1 Blix 0.9.1, 2 Blixed 1.0, and 3 BlixKrieg Blix Krieg 2.2 themes for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter, possibly a related issue to...

CVE-2007-3886: Undefined Security Weakness

Cross-site scripting XSS vulnerability in default.asp in Element CMS allows remote attackers to inject arbitrary web script or HTML via the s parameter in a search pID action...

CVE-2007-2757: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Redoable 1.2 allow remote attackers to inject arbitrary web script or HTML via the s parameter to 1 wp-content/themes/redoable/searchloop.php or 2 wp-content/themes/redoable/header.php...

CVE-2007-1289: Undefined Security Weakness

SQL injection vulnerability in ViewBugs.php in Tyger Bug Tracking System TygerBT 1.1.3 allows remote attackers to execute arbitrary SQL commands via the s parameter...

CVE-2007-0815: Undefined Security Weakness

Cross-site scripting XSS vulnerability in imagesarchive.asp in Uapplication Uphotogallery 1.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the s parameter. NOTE: the thumbnails.asp vector is already covered by CVE-2006-3023...

CVE-2006-6708: Undefined Security Weakness

Cross-site scripting XSS vulnerability in listings.asp in MGinternet Property Site Manager allows remote attackers to inject arbitrary web script or HTML via the s parameter...

CVE-2006-6282: Undefined Security Weakness

members.php in Vikingboard 0.1.2 allows remote attackers to trigger a forced SQL error via an invalid s parameter, a different vector than CVE-2006-4709. NOTE: might only be an exposure if displayerrors is enabled, but due to lack of details, even this is not clear...

CVE-2006-5944: Undefined Security Weakness

Cross-site scripting XSS vulnerability in csm/asp/listings.asp in MGinternet Car Site Manager CSM allows remote attackers to inject arbitrary web script or HTML via the s parameter...

PT-2006-6609 · Mginternet · Mginternet Car Site Manager

Name of the Vulnerable Software and Affected Versions: MGinternet Car Site Manager CSM affected versions not specified Description: A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the s parameter in the /csm/asp/listings.asp API...

CVE-2006-4709: Undefined Security Weakness

SQL injection vulnerability in topic.php in Vikingboard 0.1b allows remote attackers to execute arbitrary SQL commands via the s parameter...

CVE-2006-4016

Cross-site scripting XSS vulnerability in /toendaCMS in toendaCMS stable 1.0.3 and earlier, and unstable 1.1 and earlier, allows remote attackers to inject arbitrary web script or HTML via the s parameter...

CVE-2006-4016: Undefined Security Weakness

Cross-site scripting XSS vulnerability in /toendaCMS in toendaCMS stable 1.0.3 and earlier, and unstable 1.1 and earlier, allows remote attackers to inject arbitrary web script or HTML via the s parameter...

CVE-2006-3023: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in thumbnails.asp in Uapplication Uphotogallery 1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 s and 2 block parameters...

CVE-2006-2532: Undefined Security Weakness

stats.php in Destiney Rated Images Script 0.5.0 allows remote attackers to obtain the installation path via an invalid s parameter, which displays the path in an error message. NOTE: this issue was originally claimed to be SQL injection, but CVE analysis shows that the problem is related to an...

CVE-2006-1777: Undefined Security Weakness

Directory traversal vulnerability in doc/index.php in Jeremy Ashcraft Simplog 0.9.2 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the s parameter, as demonstrated by injecting PHP sequences into an Apache errorlog file, which...

CVE-2006-1776: Undefined Security Weakness

PHP remote file inclusion vulnerability in doc/index.php in Jeremy Ashcraft Simplog 0.9.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the s parameter...

CVE-2006-1357: Undefined Security Weakness

Cross-site scripting XSS vulnerability in my.support.php3 in F5 Firepass 4100 SSL VPN 5.4.2 allows remote attackers to inject arbitrary web script or HTML via the s parameter...

CVE-2006-1267: Undefined Security Weakness

Invision Power Board 2.1.4 allows remote attackers to hijack sessions and possibly gain administrative privileges by obtaining the session ID from the s parameter, then replaying it in another request...

CVE-2005-4674: Undefined Security Weakness

Multiple SQL injection vulnerabilities in list.php in Complete PHP Counter allow remote attackers to execute arbitrary SQL commands via the 1 c or 2 s parameter...