CVE-2012-2910: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in SiliSoftware phpThumb 1.7.11 allow remote attackers to inject arbitrary web script or HTML via the 1 dir parameter to demo/phpThumb.demo.random.php or 2 title parameter to demo/phpThumb.demo.showpic.php...

PT-2012-4356

Name of the Vulnerable Software and Affected Versions SiliSoftware phpThumb version 1.7.11 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the dir parameter to "demo/phpThumb.demo.random.php" or the title parameter to...

CVE-2010-2655: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in private/filemanagement.php on the IBM BladeCenter with Advanced Management Module AMM firmware build ID BPET48L, and possibly other versions before 4.7 and 5.0, allows remote authenticated users to list arbitrary directories and possibly have unspecified other...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in onlinetools.org EasyImageCatalogue 1.3.1 allow remote attackers to inject arbitrary web script or HTML via the 1 search and 2 d index.php parameters to index.php, 3 dir parameter to thumber.php, and the d parameter to 4 describe.php and 5...

CVE-2008-7152: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Specimen Image Database SID, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the dir parameter to 1 client.php or 2 taxonservice.php...

CVE-2009-2116: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in admin.php in SkyBlueCanvas 1.1 r237 allows remote authenticated administrators to list directory contents via a .. dot dot in the dir parameter...

CVE-2009-1737: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in bom.php in MyPic 2.1 allows remote attackers to list files in arbitrary directories via a .. dot dot in the dir parameter...

CVE-2008-6090: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in members.php in ScriptsEz Mini Hosting Panel allows remote attackers to read arbitrary local files via a .. dot dot in the dir parameter in a view action...

CVE-2008-5994

Cross-site scripting XSS vulnerability in index.php in Check Point Connectra NGX R62 HFA01 allows remote attackers to inject arbitrary web script or HTML via the dir parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-5994: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in Check Point Connectra NGX R62 HFA01 allows remote attackers to inject arbitrary web script or HTML via the dir parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-5060: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in ModernBill 4.4 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the DIR parameter to 1 exportbatch.inc.php, 2 runautosuspend.cron.php, and 3 sendemailcache.php in include/scripts/; 4...

CVE-2008-2115: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in editor.php in ScriptsEZ.net Power Editor 2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 te and 2 dir parameters in a tempedit action...

CVE-2008-1048: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in manager/xmedia.php in Plume CMS 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the dir parameter...

CVE-2007-6623: Improper Limitation of a Pathname to a Restricted Directory

Absolute path traversal vulnerability in ZeusCMS 0.3 and earlier might allow remote attackers to list arbitrary directories via a full pathname in the dir parameter...

CVE-2007-6317: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in BarracudaDrive Web Server before 3.8 allow 1 remote attackers to read arbitrary files via certain ..\ dot dot backslash sequences in the URL path, or 2 remote authenticated users to delete arbitrary files or create arbitrary directories via a ..\ do...

CVE-2007-5984: Improper Input Validation

classes/Url.php in Justin Hagstrom AutoIndex PHP Script before 2.2.4 allows remote attackers to cause a denial of service CPU and memory consumption via a %00 sequence in the dir parameter to index.php, which triggers an erroneous "recursive calculation."...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in index.php in the File Manager module in Flatnuke 3 allows remote attackers to perform certain actions as administrators via requests containing the pathname in the dir parameter and the filename in the ffile parameter...

CVE-2007-5773: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in index.php in the File Manager module in Flatnuke 3 allows remote attackers to perform certain actions as administrators via requests containing the pathname in the dir parameter and the filename in the ffile parameter...

PT-2007-6586 · Phpcms · Phpscms

Name of the Vulnerable Software and Affected Versions: phpSCMS versions 0.0.1-Alpha1 Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the dir parameter in the includes/functions.php file. This is a remote file inclusion issue. Note that the identified code...

CVE-2007-5565: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in includes/functions.php in phpSCMS 0.0.1-Alpha1 allows remote attackers to execute arbitrary PHP code via a URL in the dir parameter. NOTE: this issue is disputed by CVE because the identified code is in a function that is not accessible via direct reques...