2399 matches found
CVE-2007-2339
Multiple SQL injection vulnerabilities in Phorum before 5.1.22 allow remote attackers to execute arbitrary SQL commands via 1 a modified recipients parameter name in a pm.php; 2 the curr parameter to the b badwords aka censorlist or c banlist module in admin.php; or 3 the "Edit groups / Add group...
CVE-2007-2339: Undefined Security Weakness
Multiple SQL injection vulnerabilities in Phorum before 5.1.22 allow remote attackers to execute arbitrary SQL commands via 1 a modified recipients parameter name in a pm.php; 2 the curr parameter to the b badwords aka censorlist or c banlist module in admin.php; or 3 the "Edit groups / Add group...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in admin.php in Phorum before 5.1.22 allow remote attackers to inject arbitrary web script or HTML via the 1 groupid parameter in the groups module or 2 the smileyid parameter in the smileys modsettings module...
CVE-2007-2248
Multiple cross-site scripting XSS vulnerabilities in admin.php in Phorum before 5.1.22 allow remote attackers to inject arbitrary web script or HTML via the 1 groupid parameter in the groups module or 2 the smileyid parameter in the smileys modsettings module...
Design/Logic Flaw
admin.php in Phorum before 5.1.22 allows remote attackers to obtain the full path via the module parameter...
CVE-2007-2248
CVE-2007-2248 involves Phorum, specifically XSS in admin.php prior to 5.1.22. The vulnerabilities affect the group_id parameter in the groups module and the smiley_id parameter in the smileys modsettings module, enabling remote attackers to inject arbitrary web script or HTML. The connected docum...
CVE-2007-2250
admin.php in Phorum before 5.1.22 allows remote attackers to obtain the full path via the module parameter...
CVE-2007-2250: Undefined Security Weakness
admin.php in Phorum before 5.1.22 allows remote attackers to obtain the full path via the module parameter...
CVE-2007-2248: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in admin.php in Phorum before 5.1.22 allow remote attackers to inject arbitrary web script or HTML via the 1 groupid parameter in the groups module or 2 the smileyid parameter in the smileys modsettings module...
Phorum 5.1.20 - 'admin.php' badwords/banlist Module SQL Injection
source: https://www.securityfocus.com/bid/23616/info Phorum is prone to multiple input-validation vulnerabilities, including an unauthorized-access issue, privilege-escalation issue, multiple SQL-injection issues, and cross-site scripting issues, because the application fails to sufficiently...
Phorum 5.1.20 - admin.php badwordsbanlist Module SQL Injection
Phorum 5.1.20 - admin.php badwordsbanlist Module SQL Injection source: https://www.securityfocus.com/bid/23616/info Phorum is prone to multiple input-validation vulnerabilities, including an unauthorized-access issue, privilege-escalation issue, multiple SQL-injection issues, and cross-site...
CVE-2007-2103: Undefined Security Weakness
Multiple PHP remote file inclusion vulnerabilities in my little forum 1.7 allow remote attackers to execute arbitrary PHP code via a URL in the lang parameter to 1 admin.php and 2 timedifference.php...
Directory traversal
Directory traversal vulnerability in admin.php in pL-PHP beta 0.9 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the lang parameter...
CVE-2007-2007
admin.php in pL-PHP beta 0.9 allows remote attackers to bypass authentication by setting the isadmin parameter to 1...
Sql injection
Multiple SQL injection vulnerabilities in admin/admin.php in Crea-Book 1.0 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 pseudo or 2 passe parameter...
Authentication flaw
admin.php in pL-PHP beta 0.9 allows remote attackers to bypass authentication by setting the isadmin parameter to 1...
CVE-2007-2008
Directory traversal vulnerability in admin.php in pL-PHP beta 0.9 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the lang parameter...
CVE-2007-2008
CVE-2007-2008 is a directory traversal vulnerability in pL-PHP beta 0.9 (admin.php) allowing remote attackers to include and execute arbitrary local files via a .. in the lang parameter. The NVD entry confirms the vulnerability and impact (partial confidentiality, integrity, and availability affe...
CVE-2007-2007
CVE-2007-2007 affects admin.php in pL-PHP beta 0.9. The vulnerability allows remote attackers to bypass authentication by setting the is_admin parameter to 1, enabling unauthorized access. The NVD entry assigns a CVSS v2 base score of 7.5 (HIGH) with Network attack vector, Low attack complexity, ...