CVE-2007-1604: Undefined Security Weakness

Multiple unrestricted file upload vulnerabilities in w-Agora Web-Agora allow remote attackers to upload and execute arbitrary PHP code 1 via a forum message with an attached file, which is stored under forums/hello/hello/notes/ or 2 by using browseavatar.php to upload a file with a double...

CVE-2007-1607: Undefined Security Weakness

search.php in w-Agora Web-Agora allows remote attackers to obtain potentially sensitive information via a ' quote value followed by certain SQL sequences in the 1 searchforum or 2 searchuser parameter, which force a SQL error...

CVE-2007-1606: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in w-Agora Web-Agora allow remote attackers to inject arbitrary web script or HTML via 1 the showuser parameter to profile.php, the 2 searchforum or 3 searchuser parameter to search.php, or 4 the userid parameter to changepassword.php...

Design/Logic Flaw

w-agora 4.2.1 allows remote attackers to obtain sensitive information by via the 1 bn array parameter to index.php, which expects a string, and 2 certain parameters to deleteforum.php, which displays the path name in the resulting error message...

CVE-2007-0606

w-agora 4.2.1 allows remote attackers to obtain sensitive information by via the 1 bn array parameter to index.php, which expects a string, and 2 certain parameters to deleteforum.php, which displays the path name in the resulting error message...

CVE-2007-0606

w-agora 4.2.1 allows remote attackers to obtain sensitive information by via the 1 bn array parameter to index.php, which expects a string, and 2 certain parameters to deleteforum.php, which displays the path name in the resulting error message...

CVE-2007-0606

CVE-2007-0606 affects w-agora 4.2.1. Vulnerability arises from bn[] parameter handling in index.php and certain parameters to delete_forum.php, allowing disclosure of server path via error messages. Impact: information disclosure; no exploitation details provided in the sources beyond error-path ...

CVE-2007-0606: Undefined Security Weakness

w-agora 4.2.1 allows remote attackers to obtain sensitive information by via the 1 bn array parameter to index.php, which expects a string, and 2 certain parameters to deleteforum.php, which displays the path name in the resulting error message...

Improper access control

W-Agora Web-Agora 4.2.1, when registerglobals is enabled, stores globals.inc under the web document root with insufficient access control, which allows remote attackers to obtain application path information via a direct request...

CVE-2007-0607

W-Agora Web-Agora 4.2.1, when registerglobals is enabled, stores globals.inc under the web document root with insufficient access control, which allows remote attackers to obtain application path information via a direct request...

CVE-2007-0607

W-Agora Web-Agora 4.2.1, when registerglobals is enabled, stores globals.inc under the web document root with insufficient access control, which allows remote attackers to obtain application path information via a direct request...

CVE-2007-0607

CVE-2007-0607 concerns w-agora 4.2.1 where enabling PHP register_globals allows disclosure of the contents of globals.inc by direct requests to the web document root, leaking server paths. The vulnerability stems from insufficient access control around globals.inc, enabling information disclosure...

W-Agora 4.2.1 - change_password.php?userid Cross-Site Scripting

W-Agora 4.2.1 - changepassword.php?userid Cross-Site Scripting source: https://www.securityfocus.com/bid/23057/info w-Agora is prone to multiple input-validation vulnerabilities, including possible SQL-injection issues and multiple cross-site scripting issues, because it fails to sufficiently...

W-Agora 4.2.1 - profile.php?showuser Cross-Site Scripting

W-Agora 4.2.1 - profile.php?showuser Cross-Site Scripting source: https://www.securityfocus.com/bid/23057/info w-Agora is prone to multiple input-validation vulnerabilities, including possible SQL-injection issues and multiple cross-site scripting issues, because it fails to sufficiently sanitize...

W-Agora 4.2.1 - Multiple Arbitrary File Upload Vulnerabilities

W-Agora 4.2.1 - Multiple Arbitrary File Upload Vulnerabilities source: https://www.securityfocus.com/bid/23055/info w-Agora is prone to multiple arbitrary file-upload vulnerabilities. An attacker can exploit these vulnerabilities to upload PHP script code and execute it in the context of the...

CVE-2007-0607: Undefined Security Weakness

W-Agora Web-Agora 4.2.1, when registerglobals is enabled, stores globals.inc under the web document root with insufficient access control, which allows remote attackers to obtain application path information via a direct request...

W-Agora 4.2.1 - search.php?search_user Cross-Site Scripting

W-Agora 4.2.1 - search.php?searchuser Cross-Site Scripting source: https://www.securityfocus.com/bid/23057/info w-Agora is prone to multiple input-validation vulnerabilities, including possible SQL-injection issues and multiple cross-site scripting issues, because it fails to sufficiently sanitiz...

W-Agora 4.2.1 - 'change_password.php?userid' Cross-Site Scripting

source: https://www.securityfocus.com/bid/23057/info w-Agora is prone to multiple input-validation vulnerabilities, including possible SQL-injection issues and multiple cross-site scripting issues, because it fails to sufficiently sanitize user-supplied data. Exploiting these issues could allow a...

W-Agora 4.2.1 - 'search.php?search_user' Cross-Site Scripting

source: https://www.securityfocus.com/bid/23057/info w-Agora is prone to multiple input-validation vulnerabilities, including possible SQL-injection issues and multiple cross-site scripting issues, because it fails to sufficiently sanitize user-supplied data. Exploiting these issues could allow a...

W-Agora 4.2.1 - 'profile.php?showuser' Cross-Site Scripting

source: https://www.securityfocus.com/bid/23057/info w-Agora is prone to multiple input-validation vulnerabilities, including possible SQL-injection issues and multiple cross-site scripting issues, because it fails to sufficiently sanitize user-supplied data. Exploiting these issues could allow a...