CVE-2006-4838

CVE-2006-4838 concerns multiple cross-site scripting (XSS) vulnerabilities in DCP-Portal SE 6.0. The flaws allow remote attackers to inject arbitrary web script or HTML via request parameters in the admin interface: in footer.inc.php (root_url and dcp_version) and in header.inc.php (root_url, pag...

CVE-2006-4838

Multiple cross-site scripting XSS vulnerabilities in DCP-Portal SE 6.0 allow remote attackers to inject arbitrary web script or HTML via the 1 rooturl and 2 dcpversion parameters in a admin/inc/footer.inc.php, and the rooturl, 3 pagetopname, 4 pagename, and 5 pageoptions parameters in b...

CVE-2006-4836

CVE-2006-4836 affects DCP-Portal SE 6.0 via SQL injection in login.php (username parameter). Describes remote SQL execution risk and notes that lostpassword.php/calendar.php vectors are covered by CVE-2005-3365 and search.php by CVE-2005-4227. No explicit remediation or patch details are provided...

CVE-2006-4837

CVE-2006-4837 affects DCP-Portal SE 6.0. The issue is described as multiple PHP remote file inclusion vulnerabilities allowing an attacker to execute arbitrary PHP code via a URL in the root parameter of two scripts: library/lib.php and library/editor/editor.php. A related behavior can trigger fu...

DCP-Portal 6.0 - adminincfooter.inc.php Multiple Cross-Site Scripting Vulnerabilities

DCP-Portal 6.0 - adminincfooter.inc.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/20024/info DCP-Portal is prone to multiple input-validation vulnerabilities, including multiple cross-site scripting, SQL-injection, and remote file-include issues,...

DCP-Portal 6.0 - 'login.php?Username' SQL Injection

source: https://www.securityfocus.com/bid/20024/info DCP-Portal is prone to multiple input-validation vulnerabilities, including multiple cross-site scripting, SQL-injection, and remote file-include issues, because the application fails to sanitize user-supplied input. A successful exploit of the...

DCP-Portal 6.0 - '/admin/inc/footer.inc.php' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/20024/info DCP-Portal is prone to multiple input-validation vulnerabilities, including multiple cross-site scripting, SQL-injection, and remote file-include issues, because the application fails to sanitize user-supplied input. A successful exploit of the...

DCP-Portal 6.0 - adminincheader.inc.php Multiple Cross-Site Scripting Vulnerabilities

DCP-Portal 6.0 - adminincheader.inc.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/20024/info DCP-Portal is prone to multiple input-validation vulnerabilities, including multiple cross-site scripting, SQL-injection, and remote file-include issues,...

DCP-Portal 6.0 - '/admin/inc/header.inc.php' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/20024/info DCP-Portal is prone to multiple input-validation vulnerabilities, including multiple cross-site scripting, SQL-injection, and remote file-include issues, because the application fails to sanitize user-supplied input. A successful exploit of the...

DCP-Portal 6.0 - login.php?Username SQL Injection

DCP-Portal 6.0 - login.php?Username SQL Injection source: https://www.securityfocus.com/bid/20024/info DCP-Portal is prone to multiple input-validation vulnerabilities, including multiple cross-site scripting, SQL-injection, and remote file-include issues, because the application fails to sanitiz...

[Kurdish Security # 8] DCP-Portal Remote File Include Vulnerability [Editor DHTML]

Kurdish Security Advisory irc.gigachat.net kurdhack http://www.milw0rm.com/exploits/1905 Editor DHTML Scripting bugz $urlpatheditor = "$rooturl/library/editor/"; $abspatheditor = "$root/library/editor/"; ? Proof Of Concept...

DCP-Portal 6.1.x - root Remote File Inclusion

DCP-Portal 6.1.x - root Remote File Inclusion ----------------------------------------------------- Advisory id: FSA:013 Author: Federico Fazzi Date: 12/06/2006, 9:31 Sinthesis: DCP-Portal 6.1.x, Remote command execution Type: high Product: http://www.dcp-portal.org/ Patch: unavailable...

f_dp-6.1.x.txt

----------------------------------------------------- Advisory id: FSA:013 Author: Federico Fazzi Date: 12/06/2006, 9:31 Sinthesis: DCP-Portal 6.1.x, Remote command execution Type: high Product: http://www.dcp-portal.org/ Patch: unavailable ----------------------------------------------------- 1...

DCP-Portal 6.1.x - 'root' Remote File Inclusion

----------------------------------------------------- Advisory id: FSA:013 Author: Federico Fazzi Date: 12/06/2006, 9:31 Sinthesis: DCP-Portal 6.1.x, Remote command execution Type: high Product: http://www.dcp-portal.org/ Patch: unavailable ----------------------------------------------------- 1...

DCP-Portal 6.1.x (root) Remote File Include Vulnerability

Exploit for unknown platform in category web applications ========================================================= DCP-Portal 6.1.x root Remote File Include Vulnerability ========================================================= ----------------------------------------------------- Advisory id:...

DCP-Portal 6.1.x (root) Remote File Include Vulnerability

No description provided by source. ----------------------------------------------------- Advisory id: FSA:013 Author: Federico Fazzi Date: 12/06/2006, 9:31 Sinthesis: DCP-Portal 6.1.x, Remote command execution Type: high Product: http://www.dcp-portal.org/ Patch: unavailable...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in DCP-Portal 6.1.1 and earlier, with registerglobals enabled, allow remote attackers to inject arbitrary web script or HTML via the 1 itsurl parameter in the documents page and 2 url parameter in the sendwrite page of a index.php; 3 subject, and ...

CVE-2006-1120

Multiple cross-site scripting XSS vulnerabilities in DCP-Portal 6.1.1 and earlier, with registerglobals enabled, allow remote attackers to inject arbitrary web script or HTML via the 1 itsurl parameter in the documents page and 2 url parameter in the sendwrite page of a index.php; 3 subject, and ...

CVE-2006-1120

CVE-2006-1120 describes multiple cross-site scripting (XSS) vulnerabilities in DCP-Portal 5.3 through 6.1.1 (and earlier) when register_globals is enabled. The affected entry lists numerous vulnerable input points across several pages: its_url in documents.php; url in send_write.php (index.php); ...

CVE-2006-1120

Multiple cross-site scripting XSS vulnerabilities in DCP-Portal 6.1.1 and earlier, with registerglobals enabled, allow remote attackers to inject arbitrary web script or HTML via the 1 itsurl parameter in the documents page and 2 url parameter in the sendwrite page of a index.php; 3 subject, and ...