RI Blog 1.3 - 'search.asp' Cross-Site Scripting

source: https://www.securityfocus.com/bid/21880/info RI Blog is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user...

CVE-2006-6720

PHP remote file inclusion vulnerability in admin/indexsitios.php in Azucar CMS 1.3 allows remote attackers to execute arbitrary PHP code via a URL in the VIEW parameter...

CVE-2006-6720

The CVE-2006-6720 entry describes a PHP remote file inclusion in Azucar CMS 1.3, exploitable through admin/index_sitios.php via a URL in the _VIEW parameter to execute arbitrary PHP code. Documented CVSSv2 base metrics indicate a HIGH overall risk (Network vector, Low attack complexity, no authen...

CVE-2006-6447

Vuln: CVE-2006-6447 affects Vt-Forum Lite 1.3 and 1.5. Affected component: vf_info.asp (StrMes parameter) and possibly a URL in the SRC attribute of an IFRAME submitted to vf_newtopic.asp, enabling remote XSS through input vectors described in the description. Impact and specifics are limited to ...

vtforum-13.txt

LiderHack.Org script name : Vt-Forum Lite System V.1.3 Script Download : http://aspindir.com/indir.asp?id=585 Risk : High Found By : St@rExT Thanks : Dekolax , ShaFuck31 , ST@ReXT , Dekolax , SwatHack , Maverick , Candark , Torlaq , Woheras , Siruas Vulnerable file : vfinfo.asp XSS Bug:...

TWiki失败登录信息泄露漏洞

TWiki是一款流行的基于WEB的百科全书程序。 TWiki处理失败登录存在问题，远程攻击者可以利用漏洞访问受限制的标题。 当站点设置为如下： 1，如果ErrorDocument 401设置指向TWikiRegistration标题或者任意TWiki标题并且 2，使用TWiki-4.0的ApacheLogin和会话起用，或者使用SessionPlugin的早期TWiki版本，并且 3，运行了Apache 1.3。 那么可使用如下方法进行测试： 1，在左边栏点'Login'连接 2，输入合法用户名，但错误的密码 3，点"ok" 4，如果Apache重提示，再输入相同用户名和密码...

Vt-Forum Lite 1.3 - vf_info.asp?StrMes Cross-Site Scripting

Vt-Forum Lite 1.3 - vfinfo.asp?StrMes Cross-Site Scripting source: https://www.securityfocus.com/bid/21428/info Vt-Forum Lite is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrar...

Vt-Forum Lite 1.3 - 'vf_info.asp?StrMes' Cross-Site Scripting

source: https://www.securityfocus.com/bid/21428/info Vt-Forum Lite is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting use...

Vt-Forum Lite 1.3 - 'vf_newtopic.asp' IFRAME Element Cross-Site Scripting

source: https://www.securityfocus.com/bid/21428/info Vt-Forum Lite is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting use...

CVE-2006-6071

TWiki 4.0.5 and earlier, when running under Apache 1.3 using ApacheLogin with sessions and "ErrorDocument 401" redirects to a valid wiki topic, does not properly handle failed login attempts, which allows remote attackers to read arbitrary content by cancelling out of a failed authentication with...

phpPeanuts 1.3 Beta (Inspect.php) Remote File Include Vulnerability

No description provided by source. .:: Preface ::. Type : Remote File Include Scripts : Phppeanuts 1.1 Download : http://scripts.ringsworld.com/development-tools/phppeanuts-1-1.zip Founder : Hidayat Sagita aka bomm3x Contact : hidayat.sagitaatgmaildotcom .:: What ? ::. In Inspect.php file on line...

CVE-2006-5934

SQL injection vulnerability in Estate Agent Manager 1.3 and earlier affects admin/default.asp. The flaw allows remote attackers to execute arbitrary SQL commands via the UserName field, enabling potential data disclosure or modification. This is supported by the CVE/NVD entry (CVE-2006-5934) and ...

CVE-2006-5927

Affected software: ASP Scripter Easy Portal 1.4 and Live Support 1.3. - Vulnerability: SQL injection in cpLogin.asp that allows remote attackers to execute arbitrary SQL commands via the Password parameter. - Root cause: improper handling of the Password parameter leading to SQL command injection...

phpPeanuts 1.3 Beta (Inspect.php) Remote File Include Vulnerability

Exploit for unknown platform in category web applications =================================================================== phpPeanuts 1.3 Beta Inspect.php Remote File Include Vulnerability =================================================================== .:: Preface ::. Type : Remote File...

CVE-2006-5604

Directory traversal vulnerability in phpcards.header.php in phpCards 1.3 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the CardLanguageFile parameter...

CVE-2006-5587

Multiple PHP remote file inclusion vulnerabilities in MDweb 1.3 and earlier Mdweb132-postgres allow remote attackers to execute arbitrary PHP code via a URL in the cheminappli parameter in 1 admin/inc/organisations/formorg.inc.php and 2 admin/inc/organisations/countryinsert.php...

CVE-2006-5587

Multiple PHP remote file inclusion vulnerabilities in MDweb 1.3 and earlier Mdweb132-postgres allow remote attackers to execute arbitrary PHP code via a URL in the cheminappli parameter in 1 admin/inc/organisations/formorg.inc.php and 2 admin/inc/organisations/countryinsert.php...

PHP Cards <= 1.3 Remote File Inclue Vulnerability

===================================================================== PHP Cards = 1.3 Remote File Inclue Vulnerability ===================================================================== Author : Le CoPrA ===================================================================== Download Script :...

[SA21997] Amazing Little Poll "lp_settings.inc" Password Disclosure

TITLE: Amazing Little Poll "lpsettings.inc" Password Disclosure SECUNIA ADVISORY ID: SA21997 VERIFY ADVISORY: http://secunia.com/advisories/21997/ CRITICAL: Moderately critical IMPACT: Exposure of sensitive information WHERE: From remote SOFTWARE: Amazing Little Poll 1.x...

Signkorn Guestbook <= v1.3 (dir_path) Remote File Inclusion Exploit

============================================================================================== Signkorn Guestbook = v1.3 dirpath Remote File Inclusion Exploit =============================================================================================== Critical Level : Dangerous Venedor site :...