socialurl-xss.txt

Overview: SocialURL is a social community platform enabling you to organize your online identities. Connnect to all your social network sites with one URL. SocialURL fails to sufficiently sanitize user-supplied input data via login box. Class: Input Validation Error Example: 1.alert'xss' 2...

Bitweaver source code disclosure, arbitrary file upload

WwW.BugReport.ir AmnPardaz Security Research Team Title: Bitweaver R2 CMS Vendor: http://www.bitweaver.org Bugs: source code disclosure, arbitrary file upload Vulnerable Version: 2 prior versions also may be affected Exploitation: Remote with browser Fix Available: No! - Description: Bitweaver is...

Zenphoto 1.1.3 (rss.php albumnr) Remote SQL Injection Exploit

Exploit for unknown platform in category web applications ============================================================= Zenphoto 1.1.3 rss.php albumnr Remote SQL Injection Exploit ============================================================= !/usr/bin/perl -w Zenphoto 1.1.3 SQL Injection Exploit...

Bitweaver R2 CMS Remote File Upload / Disclosure Vulnerabilities

Exploit for unknown platform in category web applications ================================================================ Bitweaver R2 CMS Remote File Upload / Disclosure Vulnerabilities ================================================================ WwW.BugReport.ir AmnPardaz Security Research...

XZeroScripts XZero Community Classifieds 'config.inc.php'远程文件包含漏洞

BUGTRAQ ID: 27040 CNCAN ID:CNCAN-2007122806 XZeroScripts XZero Community Classifieds是一款基于PHP的WEB应用程序。 XZeroScripts XZero Community Classifieds不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB权限执行任意PHP代码。 问题是由于'config.inc.php'脚本对用户提交的'pathescape'参数缺少过滤，提交远程服务器上的任意文件作为包含对象，可导致以WEB权限执行任意PHP代码。 XZeroScripts XZero...

XZeroScripts XZero Community Classifieds SQL注入漏洞

BUGTRAQ ID: 27042 CNCAN ID:CNCAN-2007122807 XZeroScripts XZero Community Classifieds是一款基于PHP的WEB应用程序。 XZeroScripts XZero Community Classifieds不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击，可获得敏感信息或操作数据库。 问题是由于脚本对用户提交的WEB参数处理缺少充分过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。 XZeroScripts XZero Community...

XZeroScripts XZero Community Classifieds 本地文件包含漏洞

BUGTRAQ ID: 27041 CNCAN ID:CNCAN-2007122808 XZeroScripts XZero Community Classifieds是一款基于PHP的WEB应用程序。 XZeroScripts XZero Community Classifieds不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB权限查看系统文件内容。 问题是由于脚本对用户提交的WEB参数缺少过滤，提交包含多个\"../\"字符作为参数数据，可绕过WEB ROOT限制，以WEB权限查看系统文件内容。 XZeroScripts XZero Community...

Directory traversal

Directory traversal vulnerability in index.php in XZero Community Classifieds 4.95.11 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the pagename parameter in a page view action...

CVE-2007-6567

Directory traversal vulnerability in index.php in XZero Community Classifieds 4.95.11 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the pagename parameter in a page view action...

CVE-2007-6566

SQL injection vulnerability in post.php in XZero Community Classifieds 4.95.11 and earlier allows remote attackers to execute arbitrary SQL commands via the subcatid parameter to index.php...

Sql injection

SQL injection vulnerability in post.php in XZero Community Classifieds 4.95.11 and earlier allows remote attackers to execute arbitrary SQL commands via the subcatid parameter to index.php...

CVE-2007-6568

PHP remote file inclusion vulnerability in config.inc.php in XZero Community Classifieds 4.95.11 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the pathescape parameter...

Remote file inclusion

PHP remote file inclusion vulnerability in config.inc.php in XZero Community Classifieds 4.95.11 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the pathescape parameter...

CVE-2007-6566

CVE-2007-6566 describes an SQL injection in post.php of XZero Community Classifieds 4.95.11 and earlier. The vulnerability allows remote attackers to execute arbitrary SQL commands via the subcatid parameter to index.php. The NVD entry lists a CVSS v2 base score of 7.5 (High). No exploitation det...

CVE-2007-6568

PHP remote file inclusion vulnerability in config.inc.php in XZero Community Classifieds 4.95.11 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the pathescape parameter...

CVE-2007-6568

CVE-2007-6568 describes a PHP remote file inclusion vulnerability in the config.inc.php file of XZero Community Classifieds 4.95.11 and earlier . The issue allows remote attackers to execute arbitrary PHP code via a URL supplied in the path_escape parameter. The NVD metrics indicate a base score ...

CVE-2007-6567

CVE-2007-6567 affects XZero Community Classifieds up to version 4.95.11. The vulnerability resides in the script index.php where a directory traversal can be triggered via a pagename parameter in a page view action, allowing an attacker to include and execute arbitrary local files. This can impac...

CVE-2007-6567

Directory traversal vulnerability in index.php in XZero Community Classifieds 4.95.11 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the pagename parameter in a page view action...

CVE-2007-6566

SQL injection vulnerability in post.php in XZero Community Classifieds 4.95.11 and earlier allows remote attackers to execute arbitrary SQL commands via the subcatid parameter to index.php...

xzero-rfi.txt

XZero Community Classifieds = v4.95.11 Remote File Inclusion linK : http://www.xzeroscripts.com download: http://rapidshare.com/files/66809648/XZCl4.95.11.rar cod3d and f0unded by Kw3rLn from Romanian Security Team a.K.A http://rstzone.org we have in config.inc.php: line303:...