CVE-2009-1765

Multiple directory traversal vulnerabilities in pluck 4.6.2, when registerglobals is enabled, allow remote attackers to include and execute arbitrary local files via a .. dot dot in the langpref parameter to 1 data/modules/contactform/moduleinfo.php, 2 data/modules/blog/moduleinfo.php, and 3...

a-News from Appleple vulnerable to cross-site scripting

Overview a-News from Appleple contains a cross-site scripting vulnerability. a-News, a web log system from Appleple, contains a cross-site scripting vulnerability. Note that future releases and maintenance of a-News ended on May 14, 2009. The developer recommends users who wish to continue using ...

JVN#42927215 a-News from Appleple vulnerable to cross-site scripting

a-News, a web log system from Appleple, contains a cross-site scripting vulnerability. Note that future releases and maintenance of a-News ended on May 14, 2009. The developer recommends users who wish to continue using a web log system to use a-blog. Impact An arbitrary script may be executed on...

Oblog多用户博客程序attachment.asp页面越权漏洞

oBlog多用户博客程序是目前国内应用最广泛的博客程序。OBLOG程序已经广泛应用在国内数万家网站，覆盖国内上千万上网人群，并经过上千家知名网站的严格检测，被称为国内博客建站第一程序oBlog多用户博客程序”是目前国内应用最广泛的博客程序。 漏洞文件：attachment.asp 1. !-- include file= inc/incsyssite.asp -- 2. % 3. Dim Path,rs,FileID,ShowDownErr,uid,fileext 4. Dim SQL 5. Path = TrimRequest path 6. FileID = TrimRequest...

Pluck 4.6.2 Local File Inclusion

=-=-local file include-=-= -=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-= script::pluck version 4.6.2 ------------------------------------------------- Author: ahmadbady my site :Coming Soon =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= download from:http://www.pluck-cms.org/?file=kop2.p...

Pluck 4.6.2 (langpref) Local File Inclusion Vulnerabilities

No description provided by source. =-=-local file include-=-= -=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-= script::pluck version 4.6.2 ------------------------------------------------- Author: ahmadbady my site :Coming Soon =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= download...

Pluck CMS 4.6.2 - 'langpref' Local File Inclusion

=-=-local file include-=-= -=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-= script::pluck version 4.6.2 ------------------------------------------------- Author: ahmadbady my site :Coming Soon =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= download from:http://www.pluck-cms.org/?file=kop2.p...

Pluck CMS 4.6.2 - langpref Local File Inclusion

Pluck CMS 4.6.2 - langpref Local File Inclusion =-=-local file include-=-= -=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-= script::pluck version 4.6.2 ------------------------------------------------- Author: ahmadbady my site :Coming Soon =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=...

CVE-2009-1626

SQL injection vulnerability in public/specific.php in EZ-Blog before Beta 2 20090427, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the category parameter...

Sql injection

SQL injection vulnerability in public/specific.php in EZ-Blog before Beta 2 20090427, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the category parameter...

CVE-2009-1626

EZ-Blog before Beta 2 20090427 is affected by an SQL injection in public/specific.php via the category parameter when magic_quotes_gpc is disabled. The underlying issue is unsanitized input leading to arbitrary SQL execution. Affected product is EZ-Blog; no vendor/patch details or specific remedi...

CVE-2009-1626

SQL injection vulnerability in public/specific.php in EZ-Blog before Beta 2 20090427, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the category parameter...

CVE-2009-1609

Unrestricted file upload vulnerability in admin/uploadform.asp in Battle Blog 1.25 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file...

CVE-2009-1609

CVE-2009-1609 refers to an unrestricted file upload vulnerability in Battle Blog 1.25, specifically in admin/uploadform.asp. An attacker can upload a file with an executable extension and then access it via a direct request to the uploaded file, enabling remote code execution. The entry is suppor...

Battle Blog 1.25 - 'uploadform.asp' Arbitrary File Upload

Battle Blog 1.25 uploadform.asp Remote File Upload Vulnerability Found By : Cyber-Zone ABDELKHALEK +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ http://localhost/blog/admin/uploadform.asp After You Upload Your File You Will See The Link To THE File Just Below some demos ...

Bo-Blog 2.0.3 mod_tag.php注射漏洞

No description provided by source...

Battle Blog 1.25 (uploadform.asp) Arbitrary File Upload Vulnerability

Exploit for unknown platform in category web applications ===================================================================== Battle Blog 1.25 uploadform.asp Arbitrary File Upload Vulnerability ===================================================================== Battle Blog 1.25 uploadform.asp...

Battle Blog 1.25 - uploadform.asp Arbitrary File Upload

Battle Blog 1.25 - uploadform.asp Arbitrary File Upload Battle Blog 1.25 uploadform.asp Remote File Upload Vulnerability Found By : Cyber-Zone ABDELKHALEK +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ http://localhost/blog/admin/uploadform.asp After You Upload Your File...

WebKit - XML External Entity Information Disclosure

source: https://www.securityfocus.com/bid/35321/info WebKit is prone to a remote information-disclosure vulnerability. An attacker can exploit this issue to obtain sensitive information that may aid in further attacks. NOTE: This issue was previously covered in BID 35260 Apple Safari Prior to 4.0...

PJBlog个人博客系统cls_logAction.asp文件存在注入漏洞

PJBlog一套开源免费的中文个人博客系统程序，采用asp+Access的技术，具有相当高的运作效能以及更新率，也支持目前Blog所使用的新技术。 在文件class/clslogAction.asp中： oldcate=request.form"oldcate" //第429行 oldctype=request.form"oldtype" D = conn.execute"select catePart from blogCategory where cateID="&oldcate0 程序没有对变量oldcate做任何过滤放入sql查询语句中，导致注入漏洞的产生。 PJBlog...