Code injection

Static code injection vulnerability in index.php in Podcast Generator 1.1 and earlier allows remote authenticated administrators to inject arbitrary PHP code into config.php via the recent parameter in a config change action...

Cross site scripting

Cross-site scripting XSS vulnerability in listtest.php in eZoneScripts Living Local 1.1 allows remote attackers to inject arbitrary web script or HTML via the r parameter...

CVE-2008-6529

CVE-2008-6529 : The vulnerability is a cross-site scripting (XSS) flaw in listtest.php of eZoneScripts Living Local 1.1. The underlying issue is that an attacker can inject arbitrary web script or HTML via the r parameter. The entry shows a CVSSv2 base score of 4.3 (MEDIUM) with network attack ve...

CVE-2008-6530

The CVE-2008-6530 entry describes an Unrestricted file upload in editimage.php of eZoneScripts Living Local 1.1 . The vulnerability permits remote authenticated administrators to upload a file with an executable extension and then access it directly to execute arbitrary PHP code. This can comprom...

SA-CONTRIB-2009-015 - Tokenauth - Access bypass

The Token authentication module allows access to RSS feeds via a token without having to provide your username and password to the site. Token authentication did not properly use the Drupal Form API which would allow a malicious user to learn the site administrator's token giving them the ability...

CVE-2008-6490

CVE-2008-6490 affects FLABER 1.1 and earlier. The vulnerability resides in function/update_xml.php, which permits a remote attacker to overwrite arbitrary files by supplying the target filename in the target_file parameter. The issue can be leveraged to achieve code execution by overwriting a PHP...

CVE-2008-6490

function/updatexml.php in FLABER 1.1 and earlier allows remote attackers to overwrite arbitrary files by specifying the target filename in the targetfile parameter. NOTE: this can be leveraged for code execution by overwriting a PHP file, as demonstrated using function/uploadfile.php...

[SECURITY] [DSA 1740-1] New yaws packages fix denial of service

------------------------------------------------------------------------ Debian Security Advisory DSA-1740-1 [email protected] http://www.debian.org/security/ Steffen Joeris March 14, 2009 http://www.debian.org/security/faq -...

CVE-2009-0660

Multiple cross-site scripting XSS vulnerabilities in Mahara 1.0 before 1.0.10 and 1.1 before 1.1.2 allow remote attackers to inject arbitrary web script or HTML via a 1 profile and 2 blog, a different vulnerability than CVE-2009-0487...

CVE-2009-0864

S-Cms 1.1 Stable allows remote attackers to bypass authentication and obtain administrative access via an OK value for the login cookie...

CVE-2009-0864

S-Cms 1.1 Stable allows remote attackers to bypass authentication and obtain administrative access via an OK value for the login cookie...

CVE-2009-0863

The CVE-2009-0863 entry describes a SQL injection in S-Cms 1.1 Stable, exploitable via the id parameter in admin/delete_page.php, allowing remote execution of arbitrary SQL commands. Affected software/component: S-Cms 1.1 Stable (admin/delete_page.php). Root cause: unsafely constructed SQL query ...

SkyPortal Downloads Manager 1.1 Contents Change

@=Script :SkyPortal Downloads Manager v1.1 @=S.Site :http://skyportal.net @=Download :http://skyportal.net/downloads/modules/moddownloads11.zip @=Demo :http://vegtrafikk.net @=======================================@ @=Vul: @=http://site.com/ PATH /admindlbrowse.asp @=http://site.com/ PATH...

pPIM 1.01 (notes.php id) Remote Command Execution Exploit

Exploit for unknown platform in category web applications ========================================================= pPIM 1.01 notes.php id Remote Command Execution Exploit ========================================================= !/usr/bin/perl pPIM 1.01 notes.php id Remote Command Execution...

CVE-2008-6211

Multiple cross-site scripting XSS vulnerabilities in PhpForums.net mcGallery 1.1 allow remote attackers to inject arbitrary web script or HTML via the lang parameter to 1 admin.php, 2 index.php, 3 sess.php, 4 stats.php, 5 detail.php, 6 resize.php, and 7 show.php. NOTE: the provenance of this...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in PhpForums.net mcGallery 1.1 allow remote attackers to inject arbitrary web script or HTML via the lang parameter to 1 admin.php, 2 index.php, 3 sess.php, 4 stats.php, 5 detail.php, 6 resize.php, and 7 show.php. NOTE: the provenance of this...

CVE-2008-6211

The CVE-2008-6211 issue affects PhpForums.net mcGallery 1.1 and involves multiple XSS vulnerabilities. Arbitrary web script or HTML could be injected through the lang parameter to seven pages (admin.php, index.php, sess.php, stats.php, detail.php, resize.php, show.php). The root cause is reflecte...

S-Cms 1.1 Stable Insecure Cookie Handling / Mass Page Delete Vulns

No description provided by source. 0x01 Informations: Name : S-Cms 1.1 Stable Download : http://www.hotscripts.com/listings/jump/download/87992/ Vulnerability : Insecure Cookie Handling / Mass Page Delete Author : x0r Contact : [email protected] Notes : Proud to be Italian 0x02 Bug: Bugged fil...

S-CMS 1.1 Insecure Cookie Handling

0x01 Informations: Name : S-Cms 1.1 Stable Download : http://www.hotscripts.com/listings/jump/download/87992/ Vulnerability : Insecure Cookie Handling / Mass Page Delete Author : x0r Contact : [email protected] Notes : Proud to be Italian 0x02 Bug: Bugged file is /path/loginaction.php...

S-CMS 1.1 Stable - Insecure Cookie Handling Mass Page Delete

S-CMS 1.1 Stable - Insecure Cookie Handling Mass Page Delete 0x01 Informations: Name : S-Cms 1.1 Stable Download : http://www.hotscripts.com/listings/jump/download/87992/ Vulnerability : Insecure Cookie Handling / Mass Page Delete Author : x0r Contact : [email protected] Notes : Proud to be...