510 matches found
CVE-2006-1971
Cross-site scripting XSS vulnerability in login.php in KRANKIKOM ContentBoxX allows remote attackers to inject arbitrary web script or HTML via the action parameter...
CVE-2006-1971: Undefined Security Weakness
Cross-site scripting XSS vulnerability in login.php in KRANKIKOM ContentBoxX allows remote attackers to inject arbitrary web script or HTML via the action parameter...
Design/Logic Flaw
xFlow 5.46.11 and earlier allows remote attackers to determine the installation path of the application via the 1 action parameter to membersonly/index.cgi and 2 page parameter customerarea/index.cgi, probably due to invalid values...
Cross site scripting
DISPUTED Cross-site scripting XSS vulnerability in index.php in NZ Ecommerce allows remote attackers to inject arbitrary web script or HTML via the action parameter. NOTE: the vendor has disputed this issue in a comment on the researcher's blog, but research by CVE suggests that this might be a...
CVE-2006-1096
Cross-site scripting XSS vulnerability in index.php in NZ Ecommerce allows remote attackers to inject arbitrary web script or HTML via the action parameter. NOTE: the vendor has disputed this issue in a comment on the researcher's blog, but research by CVE suggests that this might be a legitimate...
PT-2006-2123 · Nz · Nz Ecommerce
Name of the Vulnerable Software and Affected Versions: NZ Ecommerce affected versions not specified Description: A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the action parameter in index.php. The vendor has disputed this issue, but research...
CVE-2006-1096: Undefined Security Weakness
Cross-site scripting XSS vulnerability in index.php in NZ Ecommerce allows remote attackers to inject arbitrary web script or HTML via the action parameter. NOTE: the vendor has disputed this issue in a comment on the researcher's blog, but research by CVE suggests that this might be a legitimate...
CVE-2005-4609
index.php in BugPort 1.147 and earlier allows remote attackers to obtain sensitive information such as full path and system configuration via an invalid action parameter...
CVE-2005-4497: Undefined Security Weakness
Cross-site scripting XSS vulnerability in Tangora Portal CMS 4.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the action parameter in a search page, as demonstrated using 1 page1631.aspx and 2 page496.aspx...
CVE-2005-3958
SQL injection vulnerability in index.php in Entergal MX 2.0 allows remote attackers to execute arbitrary SQL commands via the 1 idcat parameter in a showcat action and 2 the action parameter...
CVE-2005-3894
Multiple cross-site scripting XSS vulnerabilities in index.pl in Open Ticket Request System OTRS 1.0.0 through 1.3.2 and 2.0.0 through 2.0.3 allow remote authenticated users to inject arbitrary web script or HTML via 1 hex-encoded values in the QueueID parameter and 2 Action parameters...
CVE-2004-2444
CVE-2004-2444 describes a cross-site scripting (XSS) flaw in index.php of Jaws 0.3, exploitable via the action parameter to inject arbitrary script/HTML. The provided documents do not include explicit vendor/version patches or a confirmed exploit in the wild. No additional technical details, root...
CVE-2004-2444: Undefined Security Weakness
Cross-site scripting XSS vulnerability in index.php in Jaws 0.3 allows remote attackers to inject arbitrary web script or HTML via the action parameter...
CVE-2005-2580
Multiple SQL injection vulnerabilities in MyBulletinBoard MyBB 1.00 RC4 with Security Patch allow remote attackers to execute arbitrary SQL commands via the Username field in 1 index.php or 2 member.php, action parameter to 3 search.php or 4 member.php, or 5 polloptions parameter to polls.php...
CVE-2005-2318: Undefined Security Weakness
Cross-site scripting XSS vulnerability in showerr.asp in DVBBS 7.1 SP2 allows remote attackers to inject arbitrary web script or HTML via the action parameter...
CVE-2005-2001
Directory traversal vulnerability in pafiledb.php in paFileDB 3.1 and earlier allows remote attackers to include arbitrary files via a .. dot dot in the action parameter...
CVE-2005-2001
CVE-2005-2001 : The vulnerability affects paFileDB 3.1 and earlier, where a directory traversal flaw allows remote attackers to include arbitrary files via ".." in the action parameter. The NVD/CVE entries concur on the description, with a CVSS v2 base score of 5.0 (Medium) and links to historica...
CVE-2005-2001: Undefined Security Weakness
Directory traversal vulnerability in pafiledb.php in paFileDB 3.1 and earlier allows remote attackers to include arbitrary files via a .. dot dot in the action parameter...
CVE-2004-2115: Undefined Security Weakness
Multiple cross-site scripting XSS vulnerabilities in Oracle HTTP Server 1.3.22, based on Apache, allow remote attackers to execute arbitrary script as other users via the 1 action, 2 username, or 3 password parameters in an isqlplus request...