Docebo CMS 3.0.x - moduleshtmlframechatindex.php Multiple Cross-Site Scripting Vulnerabilities

Docebo CMS 3.0.x - moduleshtmlframechatindex.php Multiple Cross-Site Scripting Vulnerabilities Docebo is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the...

Docebo CMS 3.0.x - '/modules/htmlframechat/index.php' Multiple Cross-Site Scripting Vulnerabilities

Docebo is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker...

Docebo CMS 3.0.x - 'index.php?searchkey' Cross-Site Scripting

Docebo is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker...

CVE-2006-6963

Multiple PHP remote file inclusion vulnerabilities in Docebo LMS 3.0.3 allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALSwherelms parameter to 1 class.module/class.definition.php and 2 modules/scorm/scormutils.php. NOTE: this issue may overlap CVE-2006-2577...

CVE-2006-6957

PHP remote file inclusion vulnerability in addons/modmedia/body.php in Docebo 3.0.3 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALSwhereframework parameter. NOTE: this issue might be resultant from a global overwrite...

CVE-2006-6957

PHP remote file inclusion vulnerability in addons/modmedia/body.php in Docebo 3.0.3 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALSwhereframework parameter. NOTE: this issue might be resultant from a global overwrite...

CVE-2006-6963

CVE-2006-6963 affects Docebo LMS 3.0.3 and involves PHP remote file inclusions via the GLOBALS[where_lms] parameter in (1) class.module/class.definition.php and (2) modules/scorm/scorm_utils.php. Root cause is exploitation of PHP globals handling (register_globals context) enabling arbitrary PHP ...

CVE-2006-6957

Docebo 3.0.3 and earlier are affected by PHP remote file inclusion via the Docebo GLOBALS vulnerability. When PHP register_globals is enabled, an attacker can cause arbitrary PHP code execution by passing a URL through the GLOBALS[where_framework] parameter (and variants via GLOBALS[where_cms] in...

CVE-2006-6963

Multiple PHP remote file inclusion vulnerabilities in Docebo LMS 3.0.3 allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALSwherelms parameter to 1 class.module/class.definition.php and 2 modules/scorm/scormutils.php. NOTE: this issue may overlap CVE-2006-2577...

CVE-2006-6857

Cross-site scripting XSS vulnerability in modules/credits/credits.php in Docebo LMS allows remote attackers to inject arbitrary web script or HTML via the lang parameter...

CVE-2006-6857

CVE-2006-6857 is a documented cross-site scripting (XSS) vulnerability affecting Docebo LMS, specifically in the file modules/credits/credits.php . The issue allows remote attackers to inject arbitrary web script or HTML by supplying a crafted lang parameter. Per the public data, the vulnerabilit...

CVE-2006-6857

Cross-site scripting XSS vulnerability in modules/credits/credits.php in Docebo LMS allows remote attackers to inject arbitrary web script or HTML via the lang parameter...

maviportal-xss.txt

Bhhgroup.org & Trtekforum.com script name : MaviPortal tr Version : All script Download: http://www.docebo.org/doceboCms/index.php?mn=docs&op=download&pi=54&id=44 script sites : http://www.docebo.org Risk : High Found By : St@rExT Vulnerable file : arama.asp Xss Vuln:...

Docebo GLOBALS Variable Overwrite Remote File Inclusion

At least one Docebo application is installed on the remote host. Docebo has multiple PHP based applications, including a content management system DoceboCMS, a e-learning platform DoceboLMS and a knowledge maintenance system DoceboKMS By using a flaw in some PHP versions PHP4 Script distributed...

CVE-2006-3107

Multiple PHP remote file inclusion vulnerabilities in Docebo 3.0.3 and earlier, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in 1 GLOBALSwhereframework to a admin/modules/news/newsclass.php and b admin/modules/content/contentclass.php, and 2...

CVE-2006-3107

Docebo 3.0.3 and earlier are vulnerable to multiple PHP remote file inclusion flaws when PHP register_globals is enabled. The Docebo applications (DoceboCMS, DoceboLMS, DoceboKMS) expose GLOBALS-based vectors that allow an attacker to include remote files and execute code. Specifically, vectors u...

CVE-2006-3107

Multiple PHP remote file inclusion vulnerabilities in Docebo 3.0.3 and earlier, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in 1 GLOBALSwhereframework to a admin/modules/news/newsclass.php and b admin/modules/content/contentclass.php, and 2...

DoceboKms303.txt

----------------------------------------------------- Advisory id: FSA:009 Author: Federico Fazzi Date: 09/06/2006, 7:09 Sinthesis: Docebo Kms 3.0.3, Remote command execution Type: high Product: http://www.docebolms.org/ Patch: unavailable ----------------------------------------------------- 1...

DoceboCMS303.txt

----------------------------------------------------- Advisory id: FSA:007 Author: Federico Fazzi Date: 09/06/2006, 6:10 Sinthesis: Docebo CMS 3.0.3, Remote command execution Type: high Product: http://www.docebolms.org/ Patch: unavailable ----------------------------------------------------- 1...

Docebo CMS 3.0.3, Remote command execution

----------------------------------------------------- Advisory id: FSA:007 Author: Federico Fazzi Date: 09/06/2006, 6:10 Sinthesis: Docebo CMS 3.0.3, Remote command execution Type: high Product: http://www.docebolms.org/ Patch: unavailable ----------------------------------------------------- 1...