CVE-2006-4480

CVE-2006-4480 affects Nuked-Klan 1.7 SP4.3. The issue is an incomplete blacklist in the nk_CSS function (nuked.php) that can bypass anti‑XSS protections, allowing remote attackers to inject arbitrary script/HTML via a JavaScript payload in an attribute value not covered by the blacklist (demonstr...

Nuked Klan 1.7 SP4.3 : Function Anti-XSS Bypassed

// - BEGIN - // By Blwood // http://blwood.net http://blwood.net/ We can bypassed the function anti-xss called nkCSS nuked.php using like this : b id="blwood" style="width:expressionalert' http://www.blwood.net' http://www.blwood.net272929/"/b Here is the function : function nkCSS$str if $str != ...

Nuked Klan 1.7 SP4.3 : Function Anti-XSS Bypassed

// - BEGIN - // By Blwood // http://blwood.net http://blwood.net/ We can bypassed the function anti-xss called nkCSS nuked.php using like this : b id="blwood" style="width:expressionalert' http://www.blwood.net' http://www.blwood.net272929/"/b Here is the function : function nkCSS$str if $str != ...

PT-2006-5079 · Joomla · Com X-Shop

Name of the Vulnerable Software and Affected Versions: com x-shop versions 1.7 and earlier Description: A remote file inclusion issue in the com x-shop component allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig absolute path parameter. However, this issue has been...

CVE-2006-4158

PHP remote file inclusion vulnerability in Login.php in Spaminator 1.7 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the page parameter...

CVE-2006-4158

PHP remote file inclusion vulnerability in Login.php in Spaminator 1.7 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the page parameter...

CVE-2006-4158

The CVE describes a PHP remote file inclusion in Spaminator 1.7 and earlier, via Login.php where an attacker can supply a URL in the page parameter to execute arbitrary PHP code. Affected software is Spaminator (versions up to 1.7 and earlier). The vulnerability arises from including a user-contr...

Spaminator 1.7. ($page) Remote File Include

Spaminator 1.7. $page Remote File Include CreW: ToXiC BuG Found By Drago84 SourcE CodE: http://freshmeat.net/redir/spaminator/16281/urltgz/spaminator-1.7.tar.gz Page Affect is: /src/Login.php Problem is include "$page.php"; Path : Declare $page ExpL:...

Spaminator 1.7 - page Remote File Inclusion

Spaminator 1.7 - page Remote File Inclusion Spaminator 1.7. $page Remote File Include CreW: ToXiC BuG Found By Drago84 SourcE CodE: http://freshmeat.net/redir/spaminator/16281/urltgz/spaminator-1.7.tar.gz Page Affect is: /src/Login.php Problem is include "$page.php"; Path : Declare $page ExpL:...

CVE-2006-3922

PHP remote file inclusion vulnerability in modmembre/inscription.php in PortailPHP 1.7 allows remote attackers to execute arbitrary PHP code via a URL in the chemin parameter...

EUVD-2006-3916

PHP remote file inclusion vulnerability in modmembre/inscription.php in PortailPHP 1.7 allows remote attackers to execute arbitrary PHP code via a URL in the chemin parameter...

CVE-2006-3922

CVE-2006-3922 affects PortailPHP 1.7, specifically the file mod_membre/inscription.php . The vulnerability allows remote attackers to execute arbitrary PHP code by supplying a URL in the chemin parameter, indicating a PHP remote file inclusion issue. The connected documents provide a concrete des...

CVE-2006-2011

The CVE-2006-2011 issue affects 4images 1.7 and earlier, where a Cross-site scripting (XSS) flaw exists in member.php. The vulnerability is triggered via the nickname in register.php, likely involving the user_name parameter, allowing remote attackers to inject arbitrary web script or HTML. The N...

4images <= 1.7 XSS

==================== Discovered by: Qex Date: 14 April 2006 ==================== Steps:- 1- Register with this nickname:- 'scriptalertdocument.cookie/script 2- Go to http://www.SITE.com/PATH/member.php?action=showprofile&userid=ID...

CVE-2006-1547

ActionForm in Apache Software Foundation ASF Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to...

Guestbook Script 1.7 - 'include_files' Remote Code Execution

!/usr/bin/perl use IO::Socket; print "guestbook script ' . $txt'txtfilenotfound' . ': ' . $val . ''; $tpl-register'guest', $key; ... here is includecontent function: function includecontent$path if isfile$path obstart; include$path; $content = obgetcontents; obendclean; if isset$content return...

Cross site scripting

Cross-site scripting XSS vulnerability in index.php in Nuked-klaN 1.7 allows remote attackers to inject arbitrary web script or HTML via the letter parameter...

CVE-2006-0506

Cross-site scripting XSS vulnerability in index.php in Nuked-klaN 1.7 allows remote attackers to inject arbitrary web script or HTML via the letter parameter...

CVE-2006-0506

CVE-2006-0506 is an XSS vulnerability in Nuked-klaN 1.7, exploitable via the letter parameter in index.php. The issue arises from insufficient input sanitization, allowing remote attackers to inject arbitrary script or HTML. The entry is corroborated by multiple sources (NVD records and CVE listi...

CVE-2006-0506

Cross-site scripting XSS vulnerability in index.php in Nuked-klaN 1.7 allows remote attackers to inject arbitrary web script or HTML via the letter parameter...