CVE-2010-3306

Directory traversal vulnerability in the modURL function in instance.c in Weborf before 0.12.3 allows remote attackers to read arbitrary files via ..%2f sequences in a URI...

Clearsite 'header.php' Remote File Include Vulnerability

Clearsite is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied input. Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible. OpenVAS Vulnerability Test $Id:...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in ClearSite Beta 4.50, and possibly other versions, allow remote attackers to execute arbitrary PHP code via a URL in the csbasepath parameter to 1 docs.php and 2 include/admin/deviceadmin.php. NOTE: the header.php vector is already covered by...

CVE-2009-3306

CVE-2009-3306 is tied to ClearSite 4.50 and involves a remote file inclusion (RFI) in include/header.php. The underlying issue is unsanitized user input via the cs_base_path parameter, allowing an attacker to cause arbitrary PHP code execution. OpenVAS entries corroborate a header.php RFI vector ...

CVE-2009-3306

creationtimestamp| type| source ---|---|--- 2009-09-18 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/9716...

MariaDB / Oracle MySQL Detection (MySQL Protocol)

MySQL protocol-based detection of MariaDB / Oracle MySQL. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2008-3306

SQL injection vulnerability in info.php in C. Desseno YouTube Blog ytb 0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter, a different vector than CVE-2008-3307. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

Sql injection

SQL injection vulnerability in todos.php in C. Desseno YouTube Blog ytb 0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter, a different vector than CVE-2008-3306...

CVE-2008-3306

CVE-2008-3306 targets C. Desseno YouTube Blog (ytb) 0.1. The vulnerability is a SQL injection in info.php that allows remote attackers to execute arbitrary SQL commands via the id parameter (a vector distinct from CVE-2008-3307). Associated records indicate a second, related entry (CVE-2008-3307)...

CVE-2008-3306

creationtimestamp| type| source ---|---|--- 2008-07-22 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/6117...

Immunity Canvas: MINIBILL_INCLUDE

Name| minibillinclude ---|--- CVE| CVE-2007-3306 Exploit Pack| CANVAS Description| MiniBill Include Notes| CVSS: 7.5 Repeatability: Infinite VENDOR: Ultrize.com CVE Url: https://vulners.com/cve/CVE-2007-3306 CVE Name: CVE-2007-3306...

CVE-2007-3306

PHP remote file inclusion vulnerability in crontab/runbilling.php in MiniBill 1.2.5 allows remote attackers to execute arbitrary PHP code via a URL in the configincludedir parameter, a different vector than CVE-2006-4489...

CVE-2007-3306

CVE-2007-3306 describes a PHP remote file inclusion in MiniBill 1.2.5. The flaw is in crontab/run_billing.php where an attacker can cause arbitrary PHP code execution by supplying a URL in the config[include_dir] parameter. The connected documents corroborate MiniBill 1.2.5 as affected and point ...

CVE-2006-3306

CVE-2006-3306 affects Project EROS bbsengine (lib/common.php, preparestring) with an XSS flaw. The vulnerability is in the preparestring function and could allow remote attackers to inject arbitrary web script or HTML; affected versions include before 20060501-0142-jam and possibly earlier since ...

CVE-2006-3306

Cross-site scripting XSS vulnerability in the preparestring function in lib/common.php in Project EROS bbsengine before 20060501-0142-jam, and possibly earlier versions dating back to 2006-02-23, might allow remote attackers to inject arbitrary web script or HTML via unknown vectors...

mysql50-server -- COM_TABLE_DUMP arbitrary code execution

Stefano Di Paola reports: An authenticated user could remotely execute arbitrary commands by taking advantage of a stack overflow. To take advantage of these flaws an attacker should have direct access to MySQL server communication layer port 3306 or unix socket. But if used in conjuction with so...

Symantec pcAnywhere Detection (deprecated)

Binary data 3306.prm...

CVE-2005-3306

CVE-2005-3306 describes an XSS vulnerability in index.php of FlatNuke 2.5.6, exploitable via the user parameter in a profile operation to inject arbitrary script/HTML. The vulnerability is specifically a cross-site scripting issue and is stated as a separate/vector from CVE-2005-2814, with a note...