WordPress Core 2.1.1 - '/wp-includes/theme.php?iz' Arbitrary Command Execution

source: https://www.securityfocus.com/bid/22797/info An attacker compromised the source code for Wordpress 2.1.1 and altered it to include a malicious backdoor. This backdoor introduces a code-execution vulnerability that will let remote users inject PHP code or execute operating system commands...

WordPress Core 2.1.1 - Arbitrary Command Execution

source: https://www.securityfocus.com/bid/22797/info An attacker compromised the source code for Wordpress 2.1.1 and altered it to include a malicious backdoor. This backdoor introduces a code-execution vulnerability that will let remote users inject PHP code or execute operating system commands...

WordPress 2.1.1 - wp-includestheme.php?iz Arbitrary Command Execution

WordPress 2.1.1 - wp-includestheme.php?iz Arbitrary Command Execution source: https://www.securityfocus.com/bid/22797/info An attacker compromised the source code for Wordpress 2.1.1 and altered it to include a malicious backdoor. This backdoor introduces a code-execution vulnerability that will...

Categories hierarchy phpBB Mod 2.1.2 (phpbb_root_path) RFI Exploit

No description provided by source. C xoron Name: Categories hierarchy v2.1.2 phpbbrootpath Remote File Include Exploit Script name: Ptifo mod-CH212installed Author: xoron Exploit coded by xoron Download: http://sourceforge.net/project/showfiles.php?groupid=125710 xoron.biz - xoron.info Thanx:...

Help Center Live 2.1.2 - 'module.php' Directory Traversal

source: https://www.securityfocus.com/bid/19256/info Help Center Live is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this issue to retrieve arbitrary files from the vulnerable system in the context of the affected...

Help Center Live 2.1.2 - module.php Directory Traversal

Help Center Live 2.1.2 - module.php Directory Traversal source: https://www.securityfocus.com/bid/19256/info Help Center Live is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this issue to retrieve arbitrary files...

ASP Stats Generator <= 2.1.1 SQL Injection Vulnerabilities

No description provided by source. /------------------------------------------------ IHS Public advisory -------------------------------------------------/ ASP Stats Generator SQL-ASP injection - Code Excution ASP Stats Generator is a powerful website counter, completely written in ASP programmin...

CVE-2006-2689

Multiple cross-site scripting XSS vulnerabilities in EVA-Web 2.1.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 debutimage parameter in a article-album.php3, 2 date parameter in b rubrique.php3, and the 3 perso and 4 aide parameters to c an unknown script,...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in EVA-Web 2.1.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 debutimage parameter in a article-album.php3, 2 date parameter in b rubrique.php3, and the 3 perso and 4 aide parameters to c an unknown script,...

CVE-2006-2692

Multiple unspecified vulnerabilities in aMuleWeb for AMule before 2.1.2 allow remote attackers to read arbitrary image, HTML, or PHP files via unknown vectors, probably related to directory traversal...

EVA-Web 2.1.2 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/18161/info EVA-Web is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code execute in the...

EVA-Web <=2.1.2 vuln.

EVA-Web =2.1.2 vuln. Vuln. discovered by : r0t Date: 27 may 2006 vendor:http://spip-edu.edres74.net/ affected versions:2.1.2 and prior orginal advisory:http://pridels.blogspot.com/2006/05/eva-web-212-vuln.html Vuln. Description: EVA-Web contains a flaw that allows a remote cross site scripting...

CVE-2006-2585

The connected records confirm a SQL injection vulnerability in Destiney Links Script 2.1.2, exploitable via the ID parameter. Affected component: the script’s interaction with a database (unsafely concatenated/handled SQL). Root cause: lack of input sanitization/parameterization for the ID value ...

Design/Logic Flaw

Destiney Links Script 2.1.2 does not protect library and other support files, which allows remote attackers to obtain the installation path via a direct URL to files in the 1 include and 2 themes/original directories...

CVE-2006-1711

Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict access to the 1 changeMemberPortrait, 2 deletePersonalPortrait, and 3 testCurrentPassword methods, which allows remote attackers to modify portraits...

Remote file inclusion

PHP remote file inclusion vulnerability in archive.php in Fantastic News 2.1.2 allows remote attackers to include arbitrary files via the CONFIGscriptpath variable. NOTE: 2.1.4 was also reported to be vulnerable...

CVE-2006-1154

PHP remote file inclusion vulnerability in archive.php in Fantastic News 2.1.2 allows remote attackers to include arbitrary files via the CONFIGscriptpath variable. NOTE: 2.1.4 was also reported to be vulnerable...

CVE-2006-1154

The CVE-2006-1154 entry concerns a PHP remote file inclusion vulnerability in archive.php of Fantastic News (versions 2.1.2 and reported as vulnerable in 2.1.4). The underlying issue is that the CONFIG[script_path] parameter can be exploited by remote attackers to include arbitrary files, enablin...

MyBloggie 2.1.2/2.1.3 - 'delcomment.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/17048/info MyBloggie is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code executed in...

EZDatabase 2.1.1 - 'index.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/16257/info EZDatabase is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code executed in the browser o...