Zyke CMS 1.1 - Authentication Bypass

====================================================== ZykeCMS V1.1 Auth Bypass SQL Injection Vulnerability ====================================================== Author : Giuseppe 'giudinvx' D'Inverno Email : Date : 04-16-2010 Site : http://www.giudinvx.altervista.org/ Location : Naples, Italy...

Code injection

admin/admin.php in Mole Group Sky Hunter Airline Ticket Sale Script and Bus Ticket Script allows remote attackers to change an arbitrary password via a modified userid field...

CVE-2009-4674

admin/admin.php in Mole Group Sky Hunter Airline Ticket Sale Script and Bus Ticket Script allows remote attackers to change an arbitrary password via a modified userid field...

CVE-2009-4674

admin/admin.php in Mole Group Sky Hunter Airline Ticket Sale Script and Bus Ticket Script allows remote attackers to change an arbitrary password via a modified userid field...

CVE-2009-4674

The CVE-2009-4674 entry affects Mole Group Sky Hunter Airline Ticket Sale Script and Bus Ticket Script. The flaw in admin/admin.php allows remote attackers to change an arbitrary password by modifying a user_id field, indicating an authentication/configuration weakness in the user management func...

CVE-2009-4674: Undefined Security Weakness

admin/admin.php in Mole Group Sky Hunter Airline Ticket Sale Script and Bus Ticket Script allows remote attackers to change an arbitrary password via a modified userid field...

phpBazar 'classified.php' SQL Injection Vulnerability

The host is running phpBazar and is prone to SQL Injection vulnerability. OpenVAS Vulnerability Test $Id: gbphpbazarsqlinjvuln.nasl 5323 2017-02-17 08:49:23Z teissa $ phpBazar 'classified.php' SQL Injection Vulnerability Authors: Antu Sanadi Copyright: Copyright c 2010 Greenbone Networks GmbH,...

Phpwind7.5 后台本地包含漏洞

文件：hack\rate\admin.php 源码： ?php !functionexists'readover' && exit'Forbidden'; define "HR", RP . "hack/rate/" ; define "LR", RP . "lib/" ; InitGP array 'ajax' ; $action = strtolower $job ? $job : "admin" ; $filepath = HR . "action/" . $action . "Action.php"; ! fileexists $filepath && exit ; if $jo...

CVE-2009-4623: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Advanced Comment System 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the ACSpath parameter to 1 index.php and 2 admin.php in advancedcommentsystem/. NOTE: this might only be a vulnerability when the administrator has n...

CVE-2009-4584: Improper Authentication

admin.php in dB Masters Multimedia Links Directory 3.1.3 allows remote attackers to bypass authentication and gain administrative access via a certain value of the adminlog cookie...

CVE-2009-4562: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in zp-core/admin.php in Zenphoto 1.2.5 allows remote attackers to inject arbitrary web script or HTML via the from parameter...

Simple PHP Guestbook 1.0 Administrative Access

Vendor: http://www.simplephpguestbook.com/ Version: 1.0 Tested on: Windows and Linux -------------------------------------- Simple PHP Guestbook Remote Admin Access Exploit Created by Sora + contact: vhr95zw at hotmail.com Description: Simple PHP Guestbook suffers an remote access in the guestboo...

Cross site scripting

Cross-site scripting XSS vulnerability in admin.php in phpInstantGallery 1.1 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO...

CVE-2009-4446

CVE-2009-4446 describes an XSS in phpInstantGallery 1.1 (admin.php) exploitable via PATH_INFO. Exploitation by remote attackers is possible without authentication; impacts include partial integrity breach and no confidentiality/availability effects per CVSS? (Base 4.3, MEDIUM). Connected document...

CVE-2009-4446

Cross-site scripting XSS vulnerability in admin.php in phpInstantGallery 1.1 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO...

CVE-2009-4446: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin.php in phpInstantGallery 1.1 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO...

CVE-2009-4365: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in admin.php in ScriptsEz Ez Blog 1.0 allow remote attackers to hijack the authentication of administrators for requests that 1 add a blog via the addblog action, 2 approve a comment via the approvecomment action, 3 change administrator...

CVE-2009-4262: Undefined Security Weakness

Harold Bakker's NewsScript HB-NS 1.3 allows remote attackers to obtain access to the admin control panel via a direct request to admin.php...

CVE-2009-4222: Undefined Security Weakness

phpBazar 2.1.1fix and earlier does not require administrative authentication for admin/admin.php, which allows remote attackers to obtain access to the admin control panel via a direct request...

Directory traversal

Directory traversal vulnerability in admin.php in Flashlight Free Edition allows remote attackers to include and execute arbitrary local files via a .. dot dot in the action parameter...