PT-2006-3777 · Mybloggie · Mybloggie

Name of the Vulnerable Software and Affected Versions: MyBloggie versions 2.1.1 and earlier Description: A remote file inclusion issue allows remote attackers to execute arbitrary PHP code via a URL in the mybloggie root path parameter to admin.php. The issue's validity has been disputed, with so...

CVE-2006-2859: Undefined Security Weakness

PHP remote file inclusion vulnerability in MyBloggie 2.1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the mybloggierootpath parameter to 1 admin.php or 2 scode.php. NOTE: this issue has been disputed in multiple third party followups, which say that the MyBlogg...

Remote file inclusion

PHP remote file inclusion vulnerability in Fastpublish CMS 1.6.9.d allows remote attackers to include arbitrary files via the configfsBase parameter in 1 drucken.php, 2 drucken2.php, 3 emailanbenutzer.php, 4 rechnung.php, 5 suche/search.php and 6 adminbereich/admin.php...

CVE-2006-2726

PHP remote file inclusion vulnerability in Fastpublish CMS 1.6.9.d allows remote attackers to include arbitrary files via the configfsBase parameter in 1 drucken.php, 2 drucken2.php, 3 emailanbenutzer.php, 4 rechnung.php, 5 suche/search.php and 6 adminbereich/admin.php...

CVE-2006-2726: Undefined Security Weakness

PHP remote file inclusion vulnerability in Fastpublish CMS 1.6.9.d allows remote attackers to include arbitrary files via the configfsBase parameter in 1 drucken.php, 2 drucken2.php, 3 emailanbenutzer.php, 4 rechnung.php, 5 suche/search.php and 6 adminbereich/admin.php...

CVE-2006-2635

Multiple cross-site scripting XSS vulnerabilities in Tikiwiki aka Tiki CMS/Groupware 1.9.x allow remote attackers to inject arbitrary web script or HTML via malformed nested HTML tags such as "ipt" in 1 offset and 2 days parameters in a tiki-lastchanges.php, the 3 find and 4 offset parameters in ...

CVE-2006-2635: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Tikiwiki aka Tiki CMS/Groupware 1.9.x allow remote attackers to inject arbitrary web script or HTML via malformed nested HTML tags such as " ipt" in 1 offset and 2 days parameters in a tiki-lastchanges.php, the 3 find and 4 offset parameters in...

CVE-2006-2566

Alstrasoft Article Manager Pro 1.6 allows remote attackers to obtain sensitive information via 1 a quote character or possibly an invalid value in the action parameter in a request to mrarticles.php or 2 a login QUERYSTRING to admin.php without any additional parameters, which reveal the path in...

CVE-2006-2566: Undefined Security Weakness

Alstrasoft Article Manager Pro 1.6 allows remote attackers to obtain sensitive information via 1 a quote character or possibly an invalid value in the action parameter in a request to mrarticles.php or 2 a login QUERYSTRING to admin.php without any additional parameters, which reveal the path in...

CVE-2006-2527

CVE-2006-2527 affects phpBazar 2.1.0 and earlier. The vulnerability in Admin/admin.php allows remote attackers to bypass authentication and gain unauthorized access to the administrative section by setting the action parameter to edit_member and the value parameter to 1. The description indicates...

CVE-2006-2527: Undefined Security Weakness

Admin/admin.php in phpBazar 2.1.0 and earlier allows remote attackers to bypass the authentication process and gain unauthorized access to the administrative section by setting the action parameter to editmember and the value parameter to 1...

CVE-2006-2491: Undefined Security Weakness

Cross-site scripting XSS vulnerability in 1 index.php and 2 bmc/admin.php in BoastMachine bMachine 3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly filtered when it is accessed using the $SERVER"PHPSELF" variable...

BoastMachine 3.1 - admin.php Cross-Site Scripting

BoastMachine 3.1 - admin.php Cross-Site Scripting source: https://www.securityfocus.com/bid/18012/info BoastMachine is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code execute...

Design/Logic Flaw

PlaNet Concept plaNetStat 20050127 allows remote attackers to gain administrative privileges, and view and configure log files, via a direct request to the 1 admin.php or 2 settings.php page...

CVE-2006-2338: Undefined Security Weakness

PlaNet Concept plaNetStat 20050127 allows remote attackers to gain administrative privileges, and view and configure log files, via a direct request to the 1 admin.php or 2 settings.php page...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in FarsiNews 2.5.3 Pro and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 month and 2 year parameters in a index.php, and the 3 mod parameter in b admin.php...

CVE-2006-2091

admin.php in Virtual War VWar 1.5 and versions before 1.2 allows remote attackers to obtain sensitive information via an invalid vwarroot parameter, which reveals the path in an error message...

CVE-2006-2084

Multiple cross-site scripting XSS vulnerabilities in FarsiNews 2.5.3 Pro and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 month and 2 year parameters in a index.php, and the 3 mod parameter in b admin.php...

CVE-2006-2091: Undefined Security Weakness

admin.php in Virtual War VWar 1.5 and versions before 1.2 allows remote attackers to obtain sensitive information via an invalid vwarroot parameter, which reveals the path in an error message...

CVE-2006-2084: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in FarsiNews 2.5.3 Pro and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 month and 2 year parameters in a index.php, and the 3 mod parameter in b admin.php...