CVE-2007-5312

TorrentTrader Classic 1.07 is affected by a cross-site scripting (XSS) vulnerability. An attacker can inject arbitrary script/HTML via the (1) color parameter to pjirc/css.php and (2) the cat parameter to browse.php, indicating insufficient input sanitization for these parameters. No remediation ...

CVE-2007-5311

CVE-2007-5311 concerns TorrentTrader Classic Edition 1.07. The vulnerability is in the backend/admin-functions.php component and is triggered by a directory traversal through a .. (dot dot) in the ss_uri parameter, allowing remote attackers to cause inclusion and execution of arbitrary local file...

CVE-2007-5318

TYPOlight webCMS 2.4.6 is affected by an unspecified vulnerability in preview.php that allows remote attackers to download arbitrary files via the src parameter. This entry reports a file-download capability without details on root cause or affected environments beyond TYPOlight 2.4.6, and does n...

CVE-2007-5310

The CVE-2007-5310 entry describes a PHP remote file inclusion vulnerability in the webmaster-tips.net wmtportfolio 1.0 (com_wmtportfolio) Joomla! component. The flaw allows remote attackers to execute arbitrary PHP code via a URL provided to the mosConfig_absolute_path parameter, effectively enab...

CVE-2007-5309

CVE-2007-5309 concerns a PHP remote file inclusion in the Joomla! component com_wmtgallery (Webmaster-Tips.net Flash Image Gallery) via admin.wmtgallery.php. The root cause is improper handling of the mosConfig_live_site parameter, allowing an attacker to cause the server to include a remote PHP ...

CVE-2007-5305

Multiple PHP remote file inclusion vulnerabilities in ELSEIF CMS Beta 0.6 allow remote attackers to execute arbitrary PHP code via a URL in the 1 contenus parameter to a contenus.php; the 2 tpelseifportalrepertoire parameter to b votes.php, c espaceperso.php, d enregistrement.php, e...

CVE-2007-5301

Buffer overflow in the vorbisstreaminfo function in input/vorbis/vorbisengine.c aka the vorbis input plugin in AlsaPlayer before 0.99.80-rc3 allows remote attackers to execute arbitrary code via a .OGG file with long comments...

CVE-2007-5304

CVE-2007-5304 affects ELSEIF CMS Beta 0.6. The vulnerability is multiple cross-site scripting (XSS) weaknesses that allow remote attackers to inject arbitrary web script or HTML via three parameters in PHP scripts: repertimage (utilisateurs/vousetesbannis.php), elseifvotetxtresultatduvote (utilis...

CVE-2007-5297

CVE-2007-5297 affects Minki 1.30, with a vulnerability in index.php where the page parameter enables cross-site scripting (XSS). The root cause is insufficient input handling in the affected script, allowing injection of arbitrary script/HTML by remote attackers. Public exploitation details or co...

CVE-2007-5307

Technical details about CVE-2007-5307 are not publicly available in the provided connected documents. Please monitor for updates on affected software, impact and remediation.

CVE-2007-5300

The CVE-2007-5300 issue affects wzdftpd (notably 0.8.0 and 0.8.2) and is caused by an off-by-one error in wzd_login.c that enables a stack-based buffer overflow when handling a long USER command, leading to a remote denial of service (daemon crash). Public advisory data confirm the vulnerability ...

CVE-2007-5298

CVE-2007-5298 describes multiple PHP remote file inclusion vulnerabilities in the CMS Creamotion. The flaw allows remote attackers to execute arbitrary PHP code by supplying a crafted URL in the cfg[document_uri] parameter to two admin scripts: _administration/securite.php and _administration/ges...

CVE-2007-5308

The CVE-2007-5308 entry concerns SQL injection in galerie.php of PHP Homepage M (phpHPm) 1.0 when magic_quotes_gpc is disabled. Remote attackers can modify the id parameter in a show action to execute arbitrary SQL commands (impacting confidentiality, integrity, and availability). The NVD entry l...

CVE-2007-5306

ELSEIF CMS Beta 0.6 is affected. The vulnerability allows remote attackers to obtain sensitive information (the full file path) via unspecified vectors to users/votesresultats.php. The available sources state the affected software and the exposure but do not specify the root cause details, affect...

CVE-2007-5296

dbList 8.1 contains multiple XSS vulnerabilities in dblisttest.asp, exploitable via the parameters db, pagesize, sort, strKeyWords, and table. The root cause is not explicitly described beyond generic XSS in the page, and exploitation details (vector, payload, and in-the-wild status) are not prov...

CVE-2007-5290

CVE-2007-5290 describes multiple cross-site scripting (XSS) vulnerabilities in MailBee WebMail Pro 3.4 and earlier, and possibly MailBee WebMail Pro ASP before 3.4.64, plus WebMail Lite ASP before 4.0.11 and WebMail Lite PHP before 4.0.22. The issues allow remote attackers to inject arbitrary web...

CVE-2007-5303

CVE-2007-5303 is an XSS vulnerability affecting SnewsCMS Rus 2.1, specifically in news_page.php where the page_id parameter can be leveraged to inject arbitrary web scripts or HTML. The NVD entry documents a failed/open-based impact: confidentiality=NONE, integrity=PARTIAL, availability=NONE, wit...

CVE-2007-5295

CVE-2007-5295 affects Wikepage Opus 13 2007.2 and TipiWiki 2, via index.php. The underlying issue is multiple cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary script or HTML through the PageContent and PageName parameters. Reported impact per NVD is a Par...

CVE-2007-5297

Cross-site scripting XSS vulnerability in index.php in Minki 1.30 allows remote attackers to inject arbitrary web script or HTML via the page parameter...

CVE-2007-5299

Vulnerability (CVE-2007-5299) : Multiple directory traversal flaws affect SkaDate 5.0 and 6.0 (and possibly later 6.x versions such as 6.482). An attacker can read arbitrary files by supplying .. in the view_mode parameter to (1) featured_list.php and (2) online_list.php under the member/ path. T...