2419 matches found
CVE-2009-4205
Directory traversal vulnerability in admin.php in Flashlight Free Edition allows remote attackers to include and execute arbitrary local files via a .. dot dot in the action parameter...
CVE-2009-4205
Flashlight Free Edition (
CVE-2009-4205: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in admin.php in Flashlight Free Edition allows remote attackers to include and execute arbitrary local files via a .. dot dot in the action parameter...
CVE-2009-4121
CVE-2009-4121 refers to multiple CSRF vulnerabilities in Quick.CMS 2.4 and Quick.CMS.Lite 2.4 . The flaws allow remote attackers to hijack an administrator’s authenticated session to perform actions such as (1) deleting web pages via a p-delete action to admin.php, and possibly (2) deleting produ...
CVE-2009-4120: Cross-Site Request Forgery (CSRF)
Multiple cross-site request forgery CSRF vulnerabilities in Quick.Cart 3.4 allow remote attackers to hijack the authentication of the administrator for requests that 1 delete orders via an orders-delete action to admin.php, and possibly 2 delete products or 3 delete pages via unspecified vectors...
CVE-2009-4121: Cross-Site Request Forgery (CSRF)
Multiple cross-site request forgery CSRF vulnerabilities in Quick.CMS 2.4 and Quick.CMS.Lite 2.4 allow remote attackers to hijack the authentication of the administrator for requests that 1 delete web pages via a p-delete action to admin.php, and possibly 2 delete products or 3 delete orders via...
WordPress 2.0 2.7.1 - admin.php Module Configuration Security Bypass
WordPress 2.0 2.7.1 - admin.php Module Configuration Security Bypass An attacker can exploit this issue via a browser. The following example URIs are available: http://www.example.com/wp-admin/admin.php?page=/collapsing-archives/options.txt...
WordPress 2.0 - 2.7.1 admin.php Module Configuration Security Bypass Vulnerability
No description provided by source. An attacker can exploit this issue via a browser. The following example URIs are available: http://www.example.com/wp-admin/admin.php?page=/collapsing-archives/options.txt http://www.example.com/wp-admin/admin.php?page=akismet/readme.txt...
CVE-2009-3716: Undefined Security Weakness
Unrestricted file upload vulnerability in admin.php in MCshoutbox 1.1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in smilies/...
Skybluecanvas 1.1 r237 - 'admin.php' Multiple Cross-Site Scripting Vulnerabilities
source: https://www.securityfocus.com/bid/44225/info SkyBlueCanvas is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in...
QuickCart 3.x xss xsrf Local File Inclusion Directory Traversal
No description provided by source. DISCOVERED: PaweÅ‚ 'kl3ryk' Åaskarzewski GREETZ: hawk, pin3ska, black ant, qwert666, ua and gacmaan DIRECTORY TRAVERSAL http://victim.com/?p=ONE OF THE EXISITING FILES-EXISITING ACTION IN THIS FILE- Most of actions load templates form bad directory and then thr...
CVE-2009-3508: Improper Limitation of a Pathname to a Restricted Directory
Multiple directory traversal vulnerabilities in MUJE CMS 1.0.4.34 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the 1 class parameter to admin.php and the 2 url parameter to install/install.php; and allow remote authenticated administrators to read...
CVE-2008-7221
RunCMS 1.6.1 is affected by a CSRF vulnerability that lets remote attackers hijack administrator sessions by sending crafted requests to system/admin.php, enabling (1) addition of new administrators or (2) modification of user profiles. The vulnerability is triggered through authenticated admin a...
CVE-2008-7221: Cross-Site Request Forgery (CSRF)
Cross-site request forgery CSRF vulnerability in RunCMS 1.6.1 allows remote attackers to hijack the authentication of administrators for requests that 1 add new administrators or 2 modify user profiles via a crafted request to system/admin.php...
CVE-2008-7222: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in system/admin.php in RunCMS 1.6.1 allows remote attackers to inject arbitrary web script or HTML via the ranktitle parameter in a RankForumAdd action...
CVE-2008-7171
Multiple cross-site scripting XSS vulnerabilities in Lightweight news portal LNP 1.0b allow remote attackers to inject arbitrary web script or HTML via the 1 photo parameter to showphoto.php, 2 potd parameter to showpotd.php, or 3 the Current question field in a vote action to admin.php...
CVE-2008-7171
Multiple cross-site scripting XSS vulnerabilities in Lightweight news portal LNP 1.0b allow remote attackers to inject arbitrary web script or HTML via the 1 photo parameter to showphoto.php, 2 potd parameter to showpotd.php, or 3 the Current question field in a vote action to admin.php...
CVE-2008-7171: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in Lightweight news portal LNP 1.0b allow remote attackers to inject arbitrary web script or HTML via the 1 photo parameter to showphoto.php, 2 potd parameter to showpotd.php, or 3 the Current question field in a vote action to admin.php...
CVE-2008-7172: Undefined Security Weakness
Lightweight news portal LNP 1.0b does not properly restrict access to administrator functionality, which allows remote attackers to gain administrator privileges via direct requests to admin.php with the 1 potddelete, 2 potd, 3 voteupdate, 4 vote, or 5 modifynews actions...
CVE-2008-7175: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in wp-admin/admin.php in NextGEN Gallery 0.96 and earlier plugin for Wordpress allows remote attackers to inject arbitrary web script or HTML via the picture description field in a page edit action...