CVE-2007-5161

Cross-zone scripting vulnerability in the internal browser in i-Systems Feedreader 3.10 allows remote attackers to inject arbitrary web script or HTML via an item in a feed, as demonstrated by a WordPress blog update. NOTE: this was originally reported as XSS...

sphpblog-multi.txt

Secure Network - Security Research Advisory Vuln name: Simple PHP Blog Multiple Vulnerabilities Systems affected: simplePHPBlog 0.5.0.1, simplePHPBlog 0.4.8 and all previous versions Systems not affected: - Severity: Medium Local/Remote: Remote Vendor URL: http://www.simplephpblog.com/ Authors:...

Simple PHP Blog Multiple Vulnerabilities

Secure Network - Security Research Advisory Vuln name: Simple PHP Blog Multiple Vulnerabilities Systems affected: simplePHPBlog 0.5.0.1, simplePHPBlog 0.4.8 and all previous versions Systems not affected: - Severity: Medium Local/Remote: Remote Vendor URL: http://www.simplephpblog.com/ Authors:...

CVE-2007-5071

Incomplete blacklist vulnerability in uploadimgcgi.php in Simple PHP Blog before 0.5.1 allows remote attackers to upload dangerous files and execute arbitrary code, as demonstrated by a filename ending in .php. or a .htaccess file, a different vector than CVE-2005-2733. NOTE: the vulnerability wa...

Design/Logic Flaw

Incomplete blacklist vulnerability in uploadimgcgi.php in Simple PHP Blog before 0.5.1 allows remote attackers to upload dangerous files and execute arbitrary code, as demonstrated by a filename ending in .php. or a .htaccess file, a different vector than CVE-2005-2733. NOTE: the vulnerability wa...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Simple PHP Blog SPHPBlog before 0.5.1, when registerglobals is enabled, allow remote attackers to inject arbitrary web script or HTML via certain usercolors array parameters to certain userstyle.php files under themes/, as demonstrated by the...

CVE-2007-5071

CVE-2007-5071 is an incomplete blacklist vulnerability in Simple PHP Blog. The flaw lies in upload_img_cgi.php on versions before 0.5.1, allowing remote attackers to upload dangerous files (e.g., PHP files or .htaccess) and execute arbitrary code, demonstrated by such filenames. This describes a ...

CVE-2007-5072

CVE-2007-5072 affects the Simple PHP Blog (SPHPBlog) prior to version 0.5.1. The root cause is cross-site scripting (XSS) vulnerabilities that occur when register_globals is enabled, allowing remote attackers to inject arbitrary web script or HTML via certain user_colors array parameters to files...

CVE-2007-5072

Multiple cross-site scripting XSS vulnerabilities in Simple PHP Blog SPHPBlog before 0.5.1, when registerglobals is enabled, allow remote attackers to inject arbitrary web script or HTML via certain usercolors array parameters to certain userstyle.php files under themes/, as demonstrated by the...

CVE-2007-5071

Incomplete blacklist vulnerability in uploadimgcgi.php in Simple PHP Blog before 0.5.1 allows remote attackers to upload dangerous files and execute arbitrary code, as demonstrated by a filename ending in .php. or a .htaccess file, a different vector than CVE-2005-2733. NOTE: the vulnerability wa...

SimplePHPBlog Hacking

How to hack a server with Simple PHP Blog uploading an htacess file from imguploadcgi.php page. Tested on v0.4.9 by Demential http://www.hackish.eu mailto: [email protected] video here: http://hackish.eu/video/phpblog.avi vlc download: http://www.videolan.org/vlc/...

Sa-blog 0day-vulnerability warning-the black bar safety net

Quotation First:use is PHP5,is because of the SERVER variables are not affected by the'quotes of the limit,even if it is open the escape vulnerabilityin the User-Agent second:the insert into a plurality of data inserted in the text structure of the place is insert INTO $dbprefixsessions...

SA-Blog Exp

No description provided by source. ?php //from loveshell.net $url = $argv1.'/wap/index.php'; $username = $argv2; $password = $argv3; echo" +----------------------------------------------------------------+"; echo" Uage: php.exe blogurl username password";...

Unrestricted file upload

Unrestricted file upload vulnerability in admin/pages/blog-add.php in Neuron Blog 1.1 allows remote attackers to upload and execute arbitrary PHP files in uploads/...

CVE-2007-4371

Unrestricted file upload vulnerability in admin/pages/blog-add.php in Neuron Blog 1.1 allows remote attackers to upload and execute arbitrary PHP files in uploads/...

CVE-2007-4371

CVE-2007-4371 : Unrestricted file upload vulnerability in Neuron Blog 1.1, fixed in admin/pages/blog-add.php, allows remote attackers to upload and execute arbitrary PHP files in the uploads/ directory. The issue arises from insufficient validation when handling uploads, enabling an attacker to p...

Neuron Blog Admin Permission Bypass and Remote File Upload Vulnerability

Neuron Blog Admin Permission Bypass and Remote File Upload Vulnerability ------------------------------------------------------------------------ Script : Neuron Blog Version : 1.1 Site : http://dev.localhost.be/?q=detail-script&id=11 Founder : Rizgar Contact : [email protected] and...

sblog073-xss.txt

sBlog 0.7.3 Beta XSS Vulnerabilitie Found by 0x90 www.0x90.com.ar msn & mail: [email protected] in blog http://host/blog/search.php use '"/ Welcome to the jungle!...

CVE-2007-3979

CVE-2007-3979 affects BlogSite Professional (aka Blog System) 1.x. The vulnerability is a SQL injection in index.php via the news_id parameter , allowing remote attackers to execute arbitrary SQL commands. This is a straightforward input-injection flaw in the web application layer that leads to p...

[Aria-Security] Image Racer SearchResults.asp SQL INJECTION vuln.

Aria-Security Team Image Racer SearchResults.asp SQL Injection Vendor: http://www.junctionquest.com/Software.asp Example: http://www.TARGET.com/SearchResults.asp?SearchWord=SQL COMMAND&WordSearchCrit=Yes&image.x=0&image.y=0 Example : -1 'union select username,password from admin where FIND IT YOU...