CVE-2008-3887

Multiple SQL injection vulnerabilities in index.php in dotProject 2.1.2 allow 1 remote authenticated users to execute arbitrary SQL commands via the tab parameter in a projects action, and 2 remote authenticated administrators to execute arbitrary SQL commands via the userid parameter in a viewus...

CVE-2008-3887

CVE-2008-3887 affects dotProject 2.1.2, specifically SQL injection in index.php. The vulnerabilities allow remote authenticated users to execute arbitrary SQL commands via the tab parameter in a projects action, and remote authenticated administrators to do so via the user_id parameter in a viewu...

CVE-2008-3886

CVE-2008-3886: dotProject 2.1.2 contains multiple XSS flaws in index.php, exploitable via (1) inactive (tasks action), (2) date (calendar day_view), (3) callback (public calendar), or (4) type (ticketsmith). The issue arises from reflected/scriptable input in these parameters, enabling remote inj...

dotproject-sqlxss.txt

======================================================================= . .. | | / / | | | | / \ / / /\ / / \ | | | / / \ /\ \| | / // / /\ \ / / / // http://wwwlowsec.org ======================================================================== Author: C1c4Tr1Z Date: 28/08/08...

dotProject 2.1.2 - Multiple SQL Injections Cross-Site Scripting Vulnerabilities

dotProject 2.1.2 - Multiple SQL Injections Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/30924/info dotProject is prone to multiple SQL-injection and cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may...

CVE-2008-0494

The CVE-2008-0494 entry describes a Cross-site scripting (XSS) vulnerability in Endian Firewall 2.1.2, specifically in vpnum/userslist.php where the psearch parameter can be manipulated to inject arbitrary web script/HTML. The connected documents corroborate the affected product and parameter but...

SQL Injection in fechangepassword

It has been discovered that the extension fechangepassword is open for a SQL injection when updating the password. Component Type: Third party extension. This extension is not part of the TYPO3 default installation Affected Versions: Version 2.1.2 and all versions below Vulnerability Type: SQL...

Wordpress 2.1.2 SQL Injection POC-vulnerability warning-the black bar safety net

| Scripting vulnerabilities | flyh4t | SQL Injection | Wordpress 2.1.2 SQL Injection POC | dangerous | 2007-4-4 | 2 2 ---|---|---|---|---|---|--- | ============The affected system============ Wordpress 2.1.2 | ---|---|--- | =============Vulnerability description============= null | |...

wp212-sqlinj.txt

!/usr/bin/perl -w Wordpress 2.1.2 SQL Injection POC Credits: [email protected] Thanks to ferruh [email protected] improving my exploitation skills website:www.notsosecure.com Wordpress version 2.1.2 is vulnerable to sql injection. This POC works when exploting with the credentials of a val...

Wordpress 2.1.2 (xmlrpc) Remote SQL Injection Exploit

No description provided by source. !/usr/bin/perl -w Wordpress 2.1.2 SQL Injection POC Credits: [email protected] Thanks to ferruh [email protected] improving my exploitation skills website:www.notsosecure.com Wordpress version 2.1.2 is vulnerable to sql injection. This POC works when...

CVE-2007-1732

Cross-site scripting XSS vulnerability in an mt import in wp-admin/admin.php in WordPress 2.1.2 allows remote authenticated administrators to inject arbitrary web script or HTML via the demo parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third...

CVE-2007-1732

Cross-site scripting XSS vulnerability in an mt import in wp-admin/admin.php in WordPress 2.1.2 allows remote authenticated administrators to inject arbitrary web script or HTML via the demo parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third...

CVE-2007-1732

CVE-2007-1732 describes a cross-site scripting (XSS) vulnerability in WordPress 2.1.2 related to an mt import in wp-admin/admin.php, exploitable by remote authenticated administrators through the demo parameter to inject arbitrary script/HTML. The vulnerability’s provenance includes third‑party r...

DEBIAN-CVE-2007-1384

Directory traversal vulnerability in torrent.cpp in KTorrent before 2.1.2 allows remote attackers to overwrite arbitrary files via ".." sequences in a torrent filename...

WordPress <= 2.1.1 - Multiple Vulnerabilities

The attackers can execute arbitrary commands via an eval injection vulnerability in the "ix" parameter to wp-includes/feed.php. Also, there is command execution backdoor vulnerability. Solution Update the WordPress to the latest available version at least 2.1.2...

DEBIAN-CVE-2007-1230

Multiple cross-site scripting XSS vulnerabilities in wp-includes/functions.php in WordPress before 2.1.2-alpha allow remote attackers to inject arbitrary web script or HTML via 1 the Referer HTTP header or 2 the URI, a different vulnerability than CVE-2007-1049...

CVE-2007-1230

Multiple cross-site scripting XSS vulnerabilities in wp-includes/functions.php in WordPress before 2.1.2-alpha allow remote attackers to inject arbitrary web script or HTML via 1 the Referer HTTP header or 2 the URI, a different vulnerability than CVE-2007-1049...

CVE-2007-1230

WordPress prior to 2.1.2-alpha contains cross-site scripting (XSS) vulnerabilities in wp-includes/functions.php. The issue allows remote attackers to inject arbitrary web script or HTML via the Referer HTTP header or the URI. This is the same family noted in CVE-2007-1230/1049 and is documented a...

CVE-2007-1230

Multiple cross-site scripting XSS vulnerabilities in wp-includes/functions.php in WordPress before 2.1.2-alpha allow remote attackers to inject arbitrary web script or HTML via 1 the Referer HTTP header or 2 the URI, a different vulnerability than CVE-2007-1049...

WordPress 2.1.1 - Arbitrary Command Execution

WordPress 2.1.1 - Arbitrary Command Execution source: https://www.securityfocus.com/bid/22797/info An attacker compromised the source code for Wordpress 2.1.1 and altered it to include a malicious backdoor. This backdoor introduces a code-execution vulnerability that will let remote users inject...