CVE-2007-0830: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Admin Control Panel AdminCP in Jelsoft vBulletin 3.6.4 allow remote authenticated administrators to inject arbitrary web script or HTML via unspecified vectors related to the 1 User Group Manager, 2 User Rank Manager, 3 User Title Manager, ...

vBulletin 3.6.x - Admin Control Panel Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/21157/info vBulletin is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input data. An attacker could exploit this vulnerability to have arbitrary script code execute in the context of the...

vbulletin361.txt

Author: insanity E-mail: [email protected] XSS vBulletin 3.6.1 Admin Control Panel http://www.exemplo.com/vbulletin/admincp/index.php?do=buildnavprefs&nojs=0&prefs="alert"insanity" http://www.exemplo.com/vbulletin/admincp/index.php?do=savenavprefs&nojs=0&navprefs="alert"insanity"...

CVE-2006-5203

Invision Power Board IPB 2.1.7 and earlier allows remote restricted administrators to inject arbitrary web script or HTML, or execute arbitrary SQL commands, via a forum description that contains a crafted image with PHP code, which is executed when the user visits the "Manage Forums" link in the...

CVE-2006-5203

Invision Power Board IPB 2.1.7 and earlier allows remote restricted administrators to inject arbitrary web script or HTML, or execute arbitrary SQL commands, via a forum description that contains a crafted image with PHP code, which is executed when the user visits the "Manage Forums" link in the...

Invision Power Board Multiple Vulnerabilities

Invision Power Board Multiple Vulnerabilities Affects: IPB =2.1.7 Risk: High An attack exists where an admin can be redirected and forced to execute SQL commands through IPB's SQL Toolbox. The following requirements must be met for this attack to take place: - The database table prefix must be...

Simple GuestBook Bug

.:. Simple one-file guestbook 1.0 .:. Date: ----- August 08, 2006 Vendor: ------- http://www.xeroxer.com/index.php?page=3 Description: ------------ This is my simple one-file guestbook. It's made of one .php file the script and one .txt file the entrystorage file. It uses no database just a flat...

Free Articles Directory Remote Command Exucetion

Web Site : http://www.99articles.com Script Demo Site : http://www.articlesone.com General : 1. Support rssfeed XML to distribute articles for others website and blogs. It will make grow website popularity 2. Newsletter to be growing visitors 3. Membership system for writer participants submit...

[eVuln] WebspotBlogging Authentication Bypass Vulnerability

New eVuln Advisory: WebspotBlogging Authentication Bypass Vulnerability http://evuln.com/vulns/41/summary.html --------------------Summary---------------- Software: WebspotBlogging Sowtware's Web Site: http://www.webspot.co.uk/ Versions: 3.0 Critical Level: Dangerous Type: SQL Injection Class:...

12allSQL.txt

1-2-All Broadcast E-mail Software POC Supplying the following is sufficient to gain access to the admin control panel: Target : http://www.example.com/12allTarget/admin/index.php Username: ' or 1=1 / Password: NothingBlank Report By : POPO FromIRAN www.Babol-Hackers.com [email protected] Y! ID :...

1-2-All Broadcast E-mail Software vulnerable to a classic SQL admin

1-2-All Broadcast E-mail Software POC Supplying the following is sufficient to gain access to the admin control panel: Target : http://www.example.com/12allTarget/admin/index.php Username: ' or 1=1 / Password: NothingBlank Report By : POPO FromIRAN www.Babol-Hackers.com [email protected] Y! ID :...

ActiveCampaign 1-2-All Broadcast Email 4.0 - Admin Control Panel Username SQL Injection

ActiveCampaign 1-2-All Broadcast Email 4.0 - Admin Control Panel Username SQL Injection source: https://www.securityfocus.com/bid/15400/info ActiveCampaign 1-2-All Broadcast Email is prone to an SQL-injection vulnerability. This is an input-validation issue related to data that will be used in SQ...

ActiveCampaign 1-2-All Broadcast Email 4.0 - Admin Control Panel 'Username' SQL Injection

source: https://www.securityfocus.com/bid/15400/info ActiveCampaign 1-2-All Broadcast Email is prone to an SQL-injection vulnerability. This is an input-validation issue related to data that will be used in SQL queries, allowing a remote user to influence the structure and logic of a query...

[Full-disclosure] HYSA-2005-009 Elite Forum 1.0.0.0 XSS Vulnerability

------------------------------------------------------ HYSA-2005-009 h4cky0u.org Advisory 009 ------------------------------------------------------ Date - Tue Nov 1 2005 TITLE: ====== Elite Forum 1.0.0.0 XSS Vulnerability SEVERITY: ========= Medium SOFTWARE: ========= Elite Forum 1.0.0.0 INFO:...

vBulletin 1.0.1 lite/2.x/3.0 - '/admincp/user.php' Multiple SQL Injections

source: https://www.securityfocus.com/bid/14872/info vBulletin is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. Successful exploitation could result in a compromise of...

MyBBRC4.txt

SQL Injection Vulnerabilities in MyBB RC 4 +Security Patch Vendor: MyBB Group Version: MyBulletinBoard 1.00 RC4+ Security Patch Risk: High if magicquotesgpc = Off URL: http://www.mybboard.com "MyBB is a powerful, efficient and free forum package developed in PHP and MySQL. MyBB has been designed...

[Full-disclosure] My Bulletin Board RC 4 Vulnerabilities

SQL Injection Vulnerabilities in MyBB RC 4 +Security Patch Vendor: MyBB Group Version: MyBulletinBoard 1.00 RC4+ Security Patch Risk: High if magicquotesgpc = Off URL: http://www.mybboard.com "MyBB is a powerful, efficient and free forum package developed in PHP and MySQL. MyBB has been designed...

CVE-2005-2478

SQL injection vulnerability in SilverNews 2.0.3 allows remote attackers to execute arbitrary SQL commands via the user field on the login page in the Admin control panel...

CVE-2005-2478

SQL injection vulnerability in SilverNews 2.0.3 allows remote attackers to execute arbitrary SQL commands via the user field on the login page in the Admin control panel...

CVE-2005-2478: Undefined Security Weakness

SQL injection vulnerability in SilverNews 2.0.3 allows remote attackers to execute arbitrary SQL commands via the user field on the login page in the Admin control panel...