aspjarSQL.txt

hello , my name is: arash setayeshi & my yahoo id is : arashpc0 I found a new vulnerability in aspjar guestbook that we can control website & go to admin control panel by sql injection. sql injection : in login pageguestbook/admin/login.asp , username should be blank & password is : ' or 'x'='x...

a new sql injection for aspjar guestbook

hello , my name is: arash setayeshi & my yahoo id is : arashpc0 I found a new vulnerability in aspjar guestbook that we can control website & go to admin control panel by sql injection. sql injection : in login pageguestbook/admin/login.asp , username should be blank & password is : ' or 'x'='x...

compozitSQL.txt

Date: 18:15 05/05/05 Subject: "Compozit Webhosting Panel Administration Vulnerability" Vulnerable version: Compozit 1.0 Description: Compozit is a France Webhosting that use Administration Panel to setup their website online.Have an Control Panel to upload,make a new directory,and modify web page...

CVE-2005-1909

The web server control panel in 602LAN SUITE 2004 allows remote attackers to make it more difficult for the administrator to read portions of log files via a "!-" sequence in an HTTP GET request in the logon, possibly due to a cross-site scripting XSS vulnerability...

CVE-2005-1909

The CVE-2005-1909 entry concerns the 602LAN SUITE 2004 web server control panel where remote attackers can disrupt administrator log readability by sending a GET request containing a

CVE-2005-1909

The web server control panel in 602LAN SUITE 2004 allows remote attackers to make it more difficult for the administrator to read portions of log files via a "!-" sequence in an HTTP GET request in the logon, possibly due to a cross-site scripting XSS vulnerability...

JiRos Upload System 1.0 - login.asp SQL Injection

JiRos Upload System 1.0 - login.asp SQL Injection source: https://www.securityfocus.com/bid/13833/info JiRo's Upload System is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query...

JiRo's Upload System 1.0 - 'login.asp' SQL Injection

source: https://www.securityfocus.com/bid/13833/info JiRo's Upload System is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation could result in a compromise of...

NEXTWEB (i)Site - login.asp SQL Injection

NEXTWEB iSite - login.asp SQL Injection source: https://www.securityfocus.com/bid/13834/info NEXTWEB iSite is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitatio...

CVE-2005-1005

ProfitCode PayProCart 3.0 allows remote attackers to bypass authentication and gain administrative privileges to the admin control panel, as demonstrated via a direct request to adminshop/index.php with hex-encoded .. sequences in the ftoedit parameter...

CVE-2005-1085

Cross-site scripting XSS vulnerability in the control panel in aeDating 3.2 allows remote attackers to inject arbitrary web script or HTML...

CVE-2005-0784

Multiple cross-site scripting XSS vulnerabilities in Phorum before 5.0.15 allow remote attackers to inject arbitrary web script or HTML via 1 the subject line to follow.php or 2 the subject line in the user's personal control panel...

CVE-2005-1085

CVE-2005-1085 : The vulnerability is a cross-site scripting (XSS) issue in the aeDating 3.2 control panel that allows remote attackers to inject arbitrary web script or HTML. Connected sources (NVD, Red Hat, CVE listings) reiterate the same description without providing technical details such as ...

CVE-2005-1085

Cross-site scripting XSS vulnerability in the control panel in aeDating 3.2 allows remote attackers to inject arbitrary web script or HTML...

CVE-2005-1005

ProfitCode PayProCart 3.0 allows remote attackers to bypass authentication and gain administrative privileges to the admin control panel, as demonstrated via a direct request to adminshop/index.php with hex-encoded .. sequences in the ftoedit parameter...

CVE-2005-1005

CVE-2005-1005 affects ProfitCode PayProCart 3.0. The vulnerability allows remote attackers to bypass authentication and gain administrative privileges in the admin control panel by issuing a direct request to adminshop/index.php containing hex-encoded .. sequences in the ftoedit parameter, enabli...

CVE-2005-0784

CVE-2005-0784 affects Phorum before 5.0.15, where multiple cross-site scripting (XSS) vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The issue is triggered via the subject line in follow.php or in the user’s personal control panel, stemming from failure to properly...

phpbb cookie admin access

-------------------------------------------------------------------- Written by [email protected] -------------------------------------------------------------------- -------------------------------------------------------------------- Exploit : 2.0.x = phpbb 2.0.12 :...

[Full-disclosure] 3 XSS Vulnerabilities in Phorum <= 5.0.14

Author: Jon Oberheide [email protected] Date: Sat, March 12th, 2005 Summary ======= Application: Phorum Vendor Website: http://www.phorum.org Affected Versions: = 5.0.14 Type of Vulnerability: Cross Site Scripting XSS About Phorum ============ Phorum is a web based message board written in PHP...

phpbb -- Insuffient check against HTML code in usercp_register.php

Neo Security Team reports: If we specify a variable in the html code any type: hidden, text, radio, check, etc with the name allowhtml, allowbbcode or allowsmilies, is going to be on the html, bbcode and smilies in our signature. This is a low risk vulnerability that allows users to bypass...