1692 matches found
CVE-2005-2781
The Avatar upload feature in FUD Forum before 2.7.0 does not properly verify uploaded files, which allows remote attackers to execute arbitrary PHP code via a file with a .php extension that contains image data followed by PHP code...
CVE-2005-2781
The Avatar upload feature in FUD Forum before 2.7.0 does not properly verify uploaded files, which allows remote attackers to execute arbitrary PHP code via a file with a .php extension that contains image data followed by PHP code...
CVE-2005-2781
The Avatar upload feature in FUD Forum before 2.7.0 does not properly verify uploaded files, which allows remote attackers to execute arbitrary PHP code via a file with a .php extension that contains image data followed by PHP code...
CVE-2005-2781
The CVE-2005-2781 entry concerns the Avatar upload feature in FUD Forum (phpgroupware) prior to 2.7.0, where uploaded files are not properly validated. This allows an attacker to craft a .php file that begins with image data and then PHP code, enabling remote arbitrary PHP code execution via the ...
Simple Machine Forum 1-0-5 (possibly prior versions) user IP address / information disclosure
Simple Machine Forum 1-0-5 possibly prior versions user IP address / information disclosure Aug 31 2005 10:37AM retrogod aliceposta it Simple Machine Forum 1-0-5 possibly prior versions user IP address / information disclosure software: site: http://www.simplemachines.org/ information disclosure:...
smf105.txt
Simple Machine Forum 1-0-5 possibly prior versions user IP address / information disclosure software: site: http://www.simplemachines.org/ information disclosure: a user can choose an sumbit an avatar url like this: http://evilsite/image.php where image.php is a file like this: When forum users...
FUD Forum < 2.7.1 PHP code injection vurnelability
Avatar upload in FUD Forum 2.7.1 may be tricked to upload a PHP file. To do so merge a graphic avatar file with a PHP file. cat foo.png foo.php uploadme.php under linux/unix. On win try notepat :...
PHP nuke XSS vulnerability
strongphP nuke exploit/strong beffects:/b all versions of php nuke bsolution:/b better filtering of offsite avatar selection. in the avatar selection of the profile, u have the option of linking to an offsite image. this is the perfect place for an exploit. by placing this line of code into the b...
CVE-2004-1969
The avatar upload capability in Open Bulletin Board OpenBB 1.0.6 and earlier allows remote attackers to execute arbitrary script by uploading files that include scripting code such as Javascript...
CVE-2004-1969
The CVE-2004-1969 entry concerns Open Bulletin Board (OpenBB)
CVE-2005-0743
The custom avatar uploading feature uploader.php for XOOPS 2.0.9.2 and earlier allows remote attackers to upload arbitrary PHP scripts, whose file extensions are not filtered...
CVE-2005-0662
Cross-site scripting XSS vulnerability in index.php for MercuryBoard 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the Avatar field...
CVE-2005-1031
RUNCMS 1.1A, and possibly other products based on e-Xoops exoops, when "Allow custom avatar upload" is enabled, does not properly verify uploaded files, which allows remote attackers to upload arbitrary files...
CVE-2005-0650
Multiple cross-site scripting XSS vulnerabilities in ProjectBB 0.4.5.1 allow remote attackers to inject arbitrary web script or HTML via 1 the pages parameter to divers.php incorrectly referred to as "drivers.php" by some sources, 2 in the search feature text area, 3 forum name, 4 site name or 5...
runcms/e-xoops 1.1A and below file upload vulnerability
Products: runcms/e-xoops 1.1A http://www.runcms.org Summary: runcms/e-xoops 1.1A and below file upload vulnerability Description =========== runcms/e-xoops is an extensible, OO Object Oriented, easy to use dynamic web content management system written in PHP. runcms/e-xoops is the ideal tool for...
CVE-2005-0259
phpBB 2.0.11, and possibly other versions, with remote avatars and avatar uploading enabled, allows local users to read arbitrary files by providing both a local and remote location for an avatar, then modifying the "Upload Avatar from a URL:" field to reference the target file...
CVE-2005-0743
The CVE describes an arbitrary PHP file upload flaw in XOOPS 2.0.9.2 and earlier, exploitable via the uploader.php feature because file extensions are not filtered. This allows remote attackers to upload and potentially execute PHP scripts, with impact on confidentiality, integrity, and availabil...
CVE-2005-0743
The custom avatar uploading feature uploader.php for XOOPS 2.0.9.2 and earlier allows remote attackers to upload arbitrary PHP scripts, whose file extensions are not filtered...
[SCAN Associates Security Advisory] xoops 2.0.9.2 and below weak file extension validation
Summary: xoops 2.0.9.2 and below weak file extension validation Description =========== XOOPS is an extensible, OO Object Oriented, easy to use dynamic web content management system written in PHP. XOOPS is the ideal tool for developing small to large dynamic community websites, intra company...
