Invision Power Board (IP.Board) 2.1 - 'admin.php' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/15344/info Invision Power Board is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code...

PHP-Nuke <= 5.2 Arbitrary File Upload Vulnerability

PHP-Nuke is prone to an arbitrary file upload vulnerability in admin.php. SPDX-FileCopyrightText: 2001 SecurITeam Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later CPE =...

CVE-2005-3082

SQL injection vulnerability in admin.php in SEO-Board 1.0.2 allows remote attackers to execute arbitrary SQL commands via the userpasssha1 value in a cookie...

CVE-2005-3082

SEO-Board 1.0.2 contains a SQL injection in admin.php exploitable via the user_pass_sha1 value in a cookie, allowing remote arbitrary SQL execution. The vulnerability details come from CVE-2005-3082/NVD; CVSS v2 base score 7.5 (HIGH) with network/low complexity, no authentication required, and pa...

CVE-2005-3082

SQL injection vulnerability in admin.php in SEO-Board 1.0.2 allows remote attackers to execute arbitrary SQL commands via the userpasssha1 value in a cookie...

CVE-2005-3082: Undefined Security Weakness

SQL injection vulnerability in admin.php in SEO-Board 1.0.2 allows remote attackers to execute arbitrary SQL commands via the userpasssha1 value in a cookie...

SEO-Board < 1.03 admin.php user_pass_sha1 Cookie SQL Injection

Binary data 3242.prm...

CVE-2005-3005: Undefined Security Weakness

Helpdesk Software Hesk allows remote attackers to bypass authentication for 1 admin.php and 2 adminmain.php by modifying the PHPSESSID session ID parameter or cookie...

CVE-2005-2887: Undefined Security Weakness

MAXdev MD-Pro 1.0.73, and possibly earlier versions, allows remote attackers to obtain sensitive information via a direct request to 1 wiki.php, 2 AutoTheme directory, 3 Blocks directory, 4 admin.php, 5 pnadmin.php, or 6 Topics directory, which reveal the path in an error message...

CVE-2005-2721: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in 1 index.php or 2 admin.php in Foojan PHP Weblog allow remote attackers to inject arbitrary web script or HTML via the Referer field in the HTTP header...

CVE-2005-2699

CVE-2005-2699 concerns PHP-Kit 1.6.1 where an unrestricted file upload in admin/admin.php via images.php allows uploading a .php file to content/images/ and executing arbitrary PHP code. The vulnerability requires the attacker to be a remote authenticated administrator, implying privilege within ...

CVE-2005-2699: Undefined Security Weakness

Unrestricted file upload vulnerability in admin/admin.php in PHPKit 1.6.1 allows remote authenticated administrators to execute arbitrary PHP code by uploading a .php file to the content/images/ directory using images.php. NOTE: if a PHPKit administrator must already have access to the end system...

CVE-2004-2443

The CVE affects Jaws 0.3. An authentication bypass is possible via an HTTP request to admin.php where the cookie is set to the MD5 hash of a null password; this is compared against the logged session variable in application.php’s logged_on function. This yields a likely auth bypass with partial c...

CVE-2004-2443

Jaws 0.3 allows remote attackers to bypass authentication and via an HTTP request to admin.php with the logged cookie set to the MD5 hash of a null password, which is compared against the logged session variable by the loggedon function in application.php...

CVE-2004-2443: Undefined Security Weakness

Jaws 0.3 allows remote attackers to bypass authentication and via an HTTP request to admin.php with the logged cookie set to the MD5 hash of a null password, which is compared against the logged session variable by the loggedon function in application.php...

CVE-2005-2423: Undefined Security Weakness

Beehive Forum allows remote attackers to obtain sensitive information via 1 an invalid finaluri or sortby parameter to index.php or a direct request to 2 admin.php, 3 attachments.inc.php, 4 banned.inc.php, 5 beehive.inc.php, 6 constants.inc.php, 7 db.inc.php, 8 dictionary.inc.php or 9...

CVE-2005-2398: Undefined Security Weakness

Multiple SQL injection vulnerabilities in PHP Surveyor 0.98 allows remote attackers to execute arbitrary SQL commands via 1 the sid, start, and id parameters to browse.php, the sid parameter to 2 dataentry.php, 3 export.php, 4 admin.php, 5 conditions.php, 6 spss.php, 7 deletesurvey.php, 8...

Multiple Vulnerabilities in PHP Surveyor

----------------------------------------------------------- Multiple Vulnerabilities in PHP Surveyor version 0.98 stable ------------------------------------------------------------ Summary: PHP Surveyor is vulnerable to many sql injections, cross site scriptings, and path disclosures. Details:...

CVE-2005-2332

CVE-2005-2332 describes a cross-site scripting (XSS) vulnerability in PHPPageProtect 1.0.0a. The issue allows remote attackers to inject arbitrary web script or HTML via the username parameter to admin.php or login.php. The provided sources confirm the affected product/version and the vulnerable ...

CVE-2005-2332: Undefined Security Weakness

Cross-site scripting XSS vulnerability in PHPPageProtect 1.0.0a allows remote attackers to inject arbitrary web script or HTML via the username parameter to 1 admin.php or 2 login.php...