Gobbl CMS 1.0 Insecure Cookie Handling

--------------------------- Gobbl Cms 1.0 I.Cookie Hand. --------------------------- Autore: x0r Evolution Team Email: [email protected] Demo Site:http://www.gobbl.net/ --------------------------- Bug In: \admin\auth.php ? include '../config.php'; $user = $POST'user'; $pass = $POST'pass'; if...

phpEmployment (php upload) Arbitrary File Upload Vulnerability

Exploit for unknown platform in category web applications ============================================================== phpEmployment php upload Arbitrary File Upload Vulnerability ============================================================== remote shell upload script: phpEmployment download...

Gobbl CMS 1.0 Insecure Cookie Handling Vulnerability

No description provided by source. --------------------------- Gobbl Cms 1.0 I.Cookie Hand. --------------------------- Autore: x0r Evolution Team Email: [email protected] Demo Site:http://www.gobbl.net/ --------------------------- Bug In: \admin\auth.php ? include '../config.php'; $user =...

Gobbl CMS 1.0 Insecure Cookie Handling Vulnerability

Exploit for unknown platform in category web applications ==================================================== Gobbl CMS 1.0 Insecure Cookie Handling Vulnerability ==================================================== --------------------------- Gobbl Cms 1.0 I.Cookie Hand...

Gobbl CMS 1.0 - Insecure Cookie Handling

--------------------------- Gobbl Cms 1.0 I.Cookie Hand. --------------------------- Autore: x0r Evolution Team Email: [email protected] Demo Site:http://www.gobbl.net/ --------------------------- Bug In: \admin\auth.php ? include '../config.php'; $user = $POST'user'; $pass = $POST'pass'; if...

Gobbl CMS 1.0 - Insecure Cookie Handling

Gobbl CMS 1.0 - Insecure Cookie Handling --------------------------- Gobbl Cms 1.0 I.Cookie Hand. --------------------------- Autore: x0r Evolution Team Email: [email protected] Demo Site:http://www.gobbl.net/ --------------------------- Bug In: \admin\auth.php ? include '../config.php'; $user...

CVE-2008-4162

Open redirect vulnerability in admin/auth.php in NooMS 1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the gsiteurl parameter...

Unfixed XSS vulnerability at www.kondi.dk

Security researcher Pragmatk, has submitted on 31/08/2008 a cross-site-scripting XSS vulnerability affecting www.kondi.dk, which at the time of submission ranked 4584145 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 13/07/2009. It is currentl...

CVE-2007-5913

CVE-2007-5913 concerns dirsys/modules/auth.php in JBC Explorer 7.20 RC1 and earlier, where authentication is not required and remote attackers can (1) delete auth.inc.php via the suppr parameter and (2) re-create auth.inc.php to establish a new account/password using login and password parameters...

xcart-rfi.txt

xCart Remote file inclusion Download script : http://www.x-cart.com// Discovered By : aLiiF a.k.a arif @debuteam 07/09/2007 HomePage : http://www.debuteam.net// Thx to : Debu Newbie Payment Yogac nyubi Rozi ^S0ng0ku^ Kuris Sonix Toxicity newbi3 R4yn4ld0 DisJocKey s3ng0k homeedition Holong...

Design/Logic Flaw

The checklogout function in class/auth.php in Help Center Live hcl 2.1.3a sends a redirect to the web browser but does not exit when administrative credentials are missing, which allows remote attackers to delete administrative users and have other unspecified impact via certain requests to 1...

CVE-2007-4240

Help Center Live (hcl) 2.1.3a contains an authentication bypass in the check_logout function of class/auth.php. When administrative credentials are missing, the function redirects but does not exit, enabling an unauthenticated attacker to trigger actions via requests to admin/departments.php, adm...

CVE-2007-3627

Multiple SQL injection vulnerabilities in PHP Lite Calendar Express 2.2 allow remote attackers to execute arbitrary SQL commands via the cid parameter to 1 login.php, 2 auth.php, and 3 subscribe.php. NOTE: the month.php, year.php, week.php, and day.php vectors are already covered by CVE-2005-4009...

Cross site scripting

Cross-site scripting XSS vulnerability in admin/auth.php in Pluxml 0.3.1 allows remote attackers to inject arbitrary web script or HTML via the msg parameter...

CVE-2007-3542

Removed by vendor...

CVE-2007-3542

CVE-2007-3542 is a cross-site scripting (XSS) vulnerability in Pluxml 0.3.1, located in admin/auth.php, exploitable by supplying a crafted msg parameter. The NVD entry lists a MEDIUM risk (CVSSv2: AV:N/AC:M/Au:N/C:N/I:P/A:N, base score 4.3) with no authentication required and no impact on confide...

TotalCalendar <= 2.402 (view_event.php) Remote SQL Injection Vulns

No description provided by source. --==+================================================================================+==--br / --==+ TotalCalendar 2.402 SQL Injection Vulnerability +==--br /...

Sql injection

SQL injection vulnerability in auth.php in Just For Fun Network Management System JFFNMS 0.8.4-pre2 allows remote attackers to execute arbitrary SQL commands via the pass parameter. NOTE: this issue reportedly exists because of an initial incomplete fix for CVE-2007-3190. The provenance of this...

CVE-2007-3189

Cross-site scripting XSS vulnerability in auth.php in Just For Fun Network Management System JFFNMS 0.8.3 allows remote attackers to inject arbitrary web script or HTML via the user parameter...

CVE-2007-3190

Multiple SQL injection vulnerabilities in auth.php in Just For Fun Network Management System JFFNMS 0.8.3, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 user and 2 pass parameters...