CVE-2005-1945

Cross-site scripting XSS vulnerability in the converthighlitewords function in Invision Blog before 1.1.2 Final allows remote attackers to inject arbitrary web script or HTML via double hex encoded highlight data...

CVE-2005-1946

Multiple SQL injection vulnerabilities in Invision Blog before 1.1.2 Final allow remote attackers to execute arbitrary SQL commands via the 1 eid parameter to an editentry, replyentry, or editcomment action, or 2 the mid parameter to an aboutme action...

CVE-2004-2127

CVE-2004-2127 concerns a directory traversal in Web Blog 1.1 that allows remote attackers to read arbitrary files via a .. in the file variable. The affected component is the Web Blog 1.1 application; root cause is improper handling of the file parameter enabling traversal to parent directories. ...

CVE-2004-2127

Directory traversal vulnerability in Web Blog 1.1 allows remote attackers to read arbitrary files via a .. dot dot in the file variable...

CVE-2004-2127: Undefined Security Weakness

Directory traversal vulnerability in Web Blog 1.1 allows remote attackers to read arbitrary files via a .. dot dot in the file variable...

WordPress Detection

The remote host is running WordPress, a free blog application written in PHP with a MySQL back-end. TRUSTED...

CVE-2004-1865

Cross-site scripting XSS vulnerability in the administration panel in bBlog 0.7.2 allows remote authenticated users with superuser privileges to inject arbitrary web script or HTML via a blog name $blogname. NOTE: if administrators are normally allowed to add HTML by other means, e.g. through...

bBlog <= 0.7.4 Multiple Vulnerabilities (SQLi, XSS)

The remote host is running bBlog, an open source blog software application. According to its banner, the remote version of this software suffers from several vulnerabilities: - A SQL Injection Vulnerability It is reportedly possible to inject SQL statements through the 'postid' parameter of the...

CVE-2005-1137

Simple PHP Blog sphpBlog 0.4.0 allows remote attackers to obtain sensitive information via a direct request to sbfunctions.php, which leaks the full pathname in a PHP error message...

CVE-2005-1169

Mafia Blog .4 BETA does not properly protect the admin directory, which allows remote attackers to execute arbitrary PHP code by using writeinfo.php to inject the code into info.php...

CVE-2005-1288

inclogincheck.asp ACS Blog 0.8 through 1.1.3 allows remote attackers to gain administrator privileges via the "in" value in a cookie...

CVE-2005-0217

SQL injection vulnerability in index.php in Invision Community Blog allows remote attackers to execute arbitrary SQL commands via the eid parameter...

CVE-2005-1135

Cross-site scripting XSS vulnerability in search.php for Simple PHP Blog sphpBlog 0.4.0 allows remote attackers to inject arbitrary web script or HTML via the q parameter...

CVE-2005-0853

betaparticle blog bp blog stores the database under the web root, which allows remote attackers to obtain sensitive information via a direct request to 1 dbBlogMX.mdb for versions before 3.0, or 2 Blog.mdb for versions 3.0 and later. NOTE: it was later reported that vector 2 also affects versions...

CVE-2005-0214

Directory traversal vulnerability in Simple PHP Blog SPHPBlog 0.3.7c allows remote attackers to read or create arbitrary files via a .. dot dot in the entry parameter...

CVE-2005-0802

Cross-site scripting XSS vulnerability in search.asp in ACS Blog 0.8 through 1.1b allows remote attackers to execute arbitrary web script or HTML via the search parameter...

CVE-2005-0945

Cross-site scripting XSS vulnerability in ACS Blog 1.1.1 allows remote attackers to inject arbitrary web script or HTML via onmouseover or onload events in 1 img, 2 link, or 3 mail tags...

CVE-2005-0854

betaparticle blog bp blog, posisbly before version 4, allows remote attackers to bypass authentication and 1 upload files via a direct request to upload.asp or 2 delete files via a direct request to myFiles.asp...

CVE-2005-1288

inclogincheck.asp ACS Blog 0.8 through 1.1.3 allows remote attackers to gain administrator privileges via the "in" value in a cookie...

CVE-2005-1288

The vulnerability CVE-2005-1288 affects ACS Blog 0.8 through 1.1.3, where attackers can gain administrator privileges by manipulating the value of the in cookie. Affected component: login/authentication flow (inc_login_check.asp). Root cause: insecure cookie handling that allows privilege escalat...