94 matches found
CVE-2006-2131
include/classpoll.php in Advanced Poll 2.0.4 uses the HTTPXFORWARDEDFOR X-Forwarded-For HTTP header to identify the IP address of a client, which makes it easier for remote attackers to spoof the source IP and bypass voting restrictions...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in Advanced Poll 2.02 allow remote attackers to inject arbitrary web script or HTML via the 1 id parameter to comments.php or 2 pollid parameter to page.php. NOTE: it is possible that this issue is resultant from CVE-2006-1616...
Sql injection
Multiple SQL injection vulnerabilities in Advanced Poll 2.02 allow remote attackers to execute arbitrary SQL commands via the 1 id parameter to comments.php or 2 pollid parameter to page.php...
CVE-2006-1616
Multiple SQL injection vulnerabilities in Advanced Poll 2.02 allow remote attackers to execute arbitrary SQL commands via the 1 id parameter to comments.php or 2 pollid parameter to page.php...
CVE-2006-1617
Multiple cross-site scripting XSS vulnerabilities in Advanced Poll 2.02 allow remote attackers to inject arbitrary web script or HTML via the 1 id parameter to comments.php or 2 pollid parameter to page.php. NOTE: it is possible that this issue is resultant from CVE-2006-1616...
CVE-2006-1617
Multiple cross-site scripting XSS vulnerabilities in Advanced Poll 2.02 allow remote attackers to inject arbitrary web script or HTML via the 1 id parameter to comments.php or 2 pollid parameter to page.php. NOTE: it is possible that this issue is resultant from CVE-2006-1616...
CVE-2006-1617
CVE-2006-1617 relates to multiple XSS vulnerabilities in Advanced Poll 2.02. The affected components are comments.php (id parameter) and page.php (poll_id parameter), allowing remote attackers to inject arbitrary script/HTML. The description notes a possible relation to CVE-2006-1616 (SQL injecti...
CVE-2006-1616
CVE-2006-1616 involves multiple SQL injection vulnerabilities in Advanced Poll 2.02. The affected component is the poll software’s pages where the (1) id parameter passed to comments.php and (2) poll_id parameter passed to page.php can be exploited to execute arbitrary SQL commands. The NVD entry...
CVE-2006-1616
Multiple SQL injection vulnerabilities in Advanced Poll 2.02 allow remote attackers to execute arbitrary SQL commands via the 1 id parameter to comments.php or 2 pollid parameter to page.php...
CVE-2005-3742
CVE-2005-3742 describes a cross-site scripting (XSS) vulnerability in the popup.php component of Advanced Poll 2.0.3 and earlier. The issue allows remote attackers to inject arbitrary web script or HTML via the poll_ident parameter. The vulnerability affects the affected Poll software as document...
Advanced Poll 2.0.22.0.3 - popup.php Cross-Site Scripting
Advanced Poll 2.0.22.0.3 - popup.php Cross-Site Scripting source: https://www.securityfocus.com/bid/15506/info Advanced Poll is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute...
CVE-2003-1179
Multiple PHP remote file inclusion vulnerabilities in Advanced Poll 2.0.2 allow remote attackers to execute arbitrary PHP code via the includepath parameter in 1 booth.php, 2 png.php, 3 pollssi.php, or 4 popup.php, the 5 basepath parameter to common.inc.php...
CVE-2003-1178
CVE-2003-1178 affects Advanced Poll 2.0.2. It exposes a vulnerability in comments.php where the (1) id, (2) template_set, or (3) action parameter can cause evaluated PHP code to run, allowing remote code execution. Impact is consistent with arbitrary PHP execution (no authentication required as p...
CVE-2003-1180
CVE-2003-1180 describes a directory traversal vulnerability in Advanced Poll 2.0.2 . The issue allows remote attackers to read arbitrary files or inject arbitrary local PHP files by using “..” sequences in the parameters base_path or pollvars[lang] when accessing admin scripts (1) index.php, (2) ...
CVE-2003-1180
Directory traversal vulnerability in Advanced Poll 2.0.2 allows remote attackers to read arbitrary files or inject arbitrary local PHP files via .. sequences in the basepath or pollvarslang parameters to the admin files 1 index.php, 2 admintplnew.php, 3 admintplmiscnew.php, 4...
CVE-2003-1181
Advanced Poll 2.0.2 allows remote attackers to obtain sensitive information via an HTTP request to info.php, which invokes the phpinfo function...
CVE-2003-1181
Advanced Poll 2.0.2 (PHP-based poll system) is affected. The vulnerability stems from info.php calling phpinfo(), allowing remote attackers to disclose sensitive information about the host PHP configuration. Exploitation is remote information disclosure; no patch/version remediation details are p...
CVE-2003-1179
Summary of CVE-2003-1179 (Advanced Poll 2.0.2): The vulnerability consists of multiple PHP remote file inclusion flaws that allow an attacker to execute arbitrary PHP code. The issue is triggered via the include_path parameter in booth.php, png.php, poll_ssi.php, or popup.php, and the base_path p...
CVE-2001-1423
The CVE-2001-1423 entry describes a privilege-escalation vulnerability in Advanced Poll prior to version 1.61 when using a flat-file database. The issue arises when an attacker can set the logged_in parameter to gain elevated privileges remotely. Documented impacts indicate partial confidentialit...