CVE-2006-3191

CVE-2006-3191 describes a Cross-site Scripting (XSS) vulnerability in MPCS 0.2, specifically in comment.php, exploitable via the pageid parameter. The issue allows remote attackers to inject arbitrary web script or HTML. The available sources confirm the affected software (MPCS 0.2) and the vulne...

CVE-2006-3191: Undefined Security Weakness

Cross-site scripting XSS vulnerability in comment.php in MPCS 0.2 allows remote attackers to inject arbitrary web script or HTML via the pageid parameter...

MPCS v0.2 - XSS

MPCS v0.2 Homepage: http://tpvgames.co.uk/mpcs Affected files: comment.php XSS vuln with cookie & full path disclosure: Direct html injection doesnt seem to work, however, if you navigate to the code below in your browser, and then post a comment on the same page, our XSS example will occure...

CVE-2006-2836

CVE-2006-2836 describes a SQL injection vulnerability in Pineapple Technologies Lore, affecting version 1.5.6 and earlier. The flaw resides in comment.php and allows remote attackers to execute arbitrary SQL commands via the article_id parameter. The confirmed impact is partial confidentiality, i...

CVE-2006-2836: Undefined Security Weakness

SQL injection vulnerability in comment.php in Pineapple Technologies Lore 1.5.6 and earlier allows remote attackers to execute arbitrary SQL commands via the articleid parameter...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in vbzoom 1.11 allow remote attackers to inject arbitrary web script or HTML via the UserID parameter to 1 comment.php or 2 contact.php. NOTE: the profile.php/UserName vector is already covered by CVE-2005-2441...

CVE-2006-1133

Multiple cross-site scripting XSS vulnerabilities in vbzoom 1.11 allow remote attackers to inject arbitrary web script or HTML via the UserID parameter to 1 comment.php or 2 contact.php. NOTE: the profile.php/UserName vector is already covered by CVE-2005-2441...

CVE-2006-1133

CVE-2006-1133 concerns vbZoom/VBZooM 1.11, where cross-site scripting (XSS) is possible via the UserID parameter passed to comment.php or contact.php. The vulnerability is described as multiple XSS flaws, enabling remote attackers to inject arbitrary script/html. The record notes that the profile...

CVE-2006-1133: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in vbzoom 1.11 allow remote attackers to inject arbitrary web script or HTML via the UserID parameter to 1 comment.php or 2 contact.php. NOTE: the profile.php/UserName vector is already covered by CVE-2005-2441...

MPCS 0.2 - 'comment.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/18470/info MPCS is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code execute in the browser of an...

CVE-2005-4649: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Advanced Guestbook 2.2 and 2.3.1 allow remote attackers to inject arbitrary web script or HTML via 1 the entry parameter in index.php and 2 the gbid parameter in comment.php. NOTE: The index.php/entry vector might be resultant from CVE-2005-154...

CVE-2005-4463: Undefined Security Weakness

WordPress before 1.5.2 allows remote attackers to obtain sensitive information via a direct request to 1 wp-includes/vars.php, 2 wp-content/plugins/hello.php, 3 wp-admin/upgrade-functions.php, 4 wp-admin/edit-form.php, 5 wp-settings.php, and 6 wp-admin/edit-form-comment.php, which leaks the path ...

CVE-2005-3509: Undefined Security Weakness

Multiple SQL injection vulnerabilities in JPortal allow remote attackers to execute arbitrary SQL commands via 1 banner.php or the id parameter to 2 print.php, 3 comment.php, and 4 news.php...

JPortal Web Portal 2.2.12.3.1 - comment.php SQL Injection

JPortal Web Portal 2.2.12.3.1 - comment.php SQL Injection source: https://www.securityfocus.com/bid/15324/info JPortal is prone to multiple SQL injection vulnerabilities. These are due to a lack of proper sanitization of user-supplied input before being used in an SQL query. Successful exploitati...

JPortal Web Portal 2.2.1/2.3.1 - 'comment.php' SQL Injection

source: https://www.securityfocus.com/bid/15324/info JPortal is prone to multiple SQL injection vulnerabilities. These are due to a lack of proper sanitization of user-supplied input before being used in an SQL query. Successful exploitation could result in a compromise of the application,...

CVE-2004-2157

The CVE-2004-2157 entry describes a cross-site scripting (XSS) vulnerability in Serendipity 0.7 beta1 (and possibly earlier versions before 0.7-beta3) in the Comment.php component. The flaw allows remote attackers to inject arbitrary HTML and PHP code via the (1) email or (2) username field, impa...

CVE-2004-2158: Undefined Security Weakness

SQL injection vulnerability in Serendipity 0.7-beta1 allows remote attackers to execute arbitrary SQL commands via the entryid parameter to 1 exit.php or 2 comment.php...

CVE-2004-2157: Undefined Security Weakness

Cross-site scripting XSS vulnerability in Comment.php in Serendipity 0.7 beta1, and possibly other versions before 0.7-beta3, allows remote attackers to inject arbitrary HTML and PHP code via the 1 email or 2 username field...

Geeklog < 1.3.12 comment.php order Parameter SQL Injection

Binary data 3050.prm...

CVE-2004-1620: Undefined Security Weakness

CRLF injection vulnerability in Serendipity before 0.7rc1 allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content from the server via the url parameter in 1 index.php and 2 exit.php, or 3 the HTTP Referer field in comment.php...