CVE-2006-2004

CVE-2006-2004 describes multiple SQL injection vulnerabilities in RI Blog 1.1 that allow remote attackers to execute arbitrary SQL commands through the (1) username or (2) password fields. The CVSS base score is 7.5 (HIGH) with network attack vector, low complexity, and no authentication required...

CVE-2006-2001

Cross-site scripting XSS vulnerability in index.php in Scry Gallery 1.1 allows remote attackers to inject arbitrary web script or HTML via the p parameter. NOTE: this is a different vulnerability than the directory traversal vector...

CVE-2006-2001

CVE-2006-2001 affects Scry Gallery 1.1, with a cross-site scripting (XSS) flaw in index.php exploitable via the p parameter. The vulnerability’s CVSS v2 vector (AV:N/AC:M/Au:N/C:N/I:P/A:N) yields a base score of 4.3 (Medium). Impact is limited to partial integrity risk; confidentiality and availa...

CVE-2006-2004

Multiple SQL injection vulnerabilities in RI Blog 1.1 allow remote attackers to execute arbitrary SQL command via the 1 username or 2 password fields...

CVE-2006-2005

CVE-2006-2005 affects ClanSys 1.1 (index.php). The vulnerability is an eval injection in the page parameter that allows remote attackers to execute arbitrary PHP code, demonstrated by injecting an include statement into the eval. Some sources describe it as a file inclusion, but the primary issue...

CVE-2006-1996

Scry Gallery 1.1 allows remote attackers to obtain sensitive information via an invalid p parameter, which reveals the path in an error message...

CVE-2006-2005

Eval injection vulnerability in index.php in ClanSys 1.1 allows remote attackers to execute arbitrary PHP code via PHP code in the page parameter, as demonstrated by using an "include" statement that is injected into the eval statement. NOTE: this issue has been described as file inclusion by som...

Scry Gallery 1.1 - index.php Cross-Site Scripting

Scry Gallery 1.1 - index.php Cross-Site Scripting source: https://www.securityfocus.com/bid/17668/info Scry Gallery is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to...

Scry Gallery XSS Vulnerability

Software : Scry Gallery v1.1 WebSite :http://scry.org/ ISSUE : The software is prone to a XSS attack using the following proof of concept : http://anysiteusingscrygallery.com/Path to scry gallery/index.php?v=list&i=0&p=scriptvar20variable=111111111111111111;alertvariable;/script One can execute...

Cross site scripting

Cross-site scripting XSS vulnerability in global.php in ShoutBOOK 1.1 allows remote attackers to inject arbitrary web script or HTML via the 1 LOCATION and 2 URL parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2006-1842

Cross-site scripting XSS vulnerability in global.php in ShoutBOOK 1.1 allows remote attackers to inject arbitrary web script or HTML via the 1 NAME and 2 COMMENTS parameters...

CVE-2006-1842

CVE-2006-1842 is a Cross-site Scripting (XSS) vulnerability affecting ShoutBOOK 1.1, located in global.php. The issue allows remote attackers to inject arbitrary web script or HTML through the NAME and COMMENTS parameters. The available documents do not specify affected versions beyond 1.1, nor p...

CVE-2006-1843

CVE-2006-1843: An XSS vulnerability in global.php of ShoutBOOK 1.1 allows remote attackers to inject arbitrary web script or HTML via the (1) LOCATION and (2) URL parameters. Affected software is ShoutBOOK 1.1; the issue arises from improper handling of user-supplied parameters, leading to reflec...

Sql injection

SQL injection vulnerability in member.php in Clansys 1.1 allows remote attackers to execute arbitrary SQL commands via the showid parameter in the member page to index.php...

CVE-2006-1708

SQL injection vulnerability in member.php in Clansys 1.1 allows remote attackers to execute arbitrary SQL commands via the showid parameter in the member page to index.php...

CVE-2006-1694

SQL injection vulnerability in members.php in XBrite Members 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2006-1694

SQL injection vulnerability in members.php in XBrite Members 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2006-1708

SQL injection vulnerability in member.php in Clansys 1.1 allows remote attackers to execute arbitrary SQL commands via the showid parameter in the member page to index.php...

Clansys 1.1 (showid) - SQL Injection

Clansys 1.1 showid - SQL Injection Internet Security | |---==============================================================---| title: clansys 1.1 remote sql injection release: 2006-04-10 author: snatcher snatcher at gmx.ch country: switzerland |+| application: clansys 1.1 description: a php / mysq...

[SA19602] XBrite Members "id" SQL Injection Vulnerability

TITLE: XBrite Members "id" SQL Injection Vulnerability SECUNIA ADVISORY ID: SA19602 VERIFY ADVISORY: http://secunia.com/advisories/19602/ CRITICAL: Moderately critical IMPACT: Manipulation of data WHERE: From remote SOFTWARE: XBrite Members 1.x http://secunia.com/product/9242/ DESCRIPTION: snatch...