CVE-2007-4290

Multiple PHP remote file inclusion vulnerabilities in Guestbook Script 1.9 allow remote attackers to execute arbitrary PHP code via a URL in the scriptroot parameter to 1 delete.php, 2 edit.php, or 3 inc/common.inc.php; or 4 database.php, 5 entries.php, 6 index.php, 7 logout.php, or 8 settings.ph...

Sql injection

SQL injection vulnerability in bb-includes/formatting-functions.php in bbPress before 0.8.1 might allow remote attackers to execute arbitrary SQL commands via unspecified vectors to forums/bb-edit.php, as demonstrated by a PRE element, aka the "quircky slashes bug."...

CVE-2007-3244

CVE-2007-3244 describes a SQL injection in bbPress prior to version 0.8.1. The vulnerability is in bb-includes/formatting-functions.php and can allow remote attackers to execute arbitrary SQL commands via unspecified vectors to forums/bb-edit.php, demonstrated by a PRE element (the “quirky slashe...

CVE-2007-3244: Undefined Security Weakness

SQL injection vulnerability in bb-includes/formatting-functions.php in bbPress before 0.8.1 might allow remote attackers to execute arbitrary SQL commands via unspecified vectors to forums/bb-edit.php, as demonstrated by a PRE element, aka the "quircky slashes bug."...

Authentication flaw

Pheap 2.0 allows remote attackers to bypass authentication by setting a pheaplogin cookie value to the administrator's username, which can be used to 1 obtain sensitive information, including the administrator password, via settings.php or 2 upload and execute arbitrary PHP code via an updatedoc...

CVE-2007-2985

Pheap 2.0 allows remote attackers to bypass authentication by setting a pheaplogin cookie value to the administrator's username, which can be used to 1 obtain sensitive information, including the administrator password, via settings.php or 2 upload and execute arbitrary PHP code via an updatedoc...

CVE-2007-2985: Undefined Security Weakness

Pheap 2.0 allows remote attackers to bypass authentication by setting a pheaplogin cookie value to the administrator's username, which can be used to 1 obtain sensitive information, including the administrator password, via settings.php or 2 upload and execute arbitrary PHP code via an updatedoc...

CVE-2007-1140

Directory traversal vulnerability in edit.php in pheap allows remote attackers to read and modify arbitrary files via a .. dot dot in the filename parameter...

CVE-2007-1140

Directory traversal vulnerability in edit.php in pheap allows remote attackers to read and modify arbitrary files via a .. dot dot in the filename parameter...

CVE-2007-1140

Directory traversal vulnerability in edit.php in pheap allows remote attackers to read and modify arbitrary files via a .. dot dot in the filename parameter...

CVE-2007-1140

The CVE-2007-1140 entry describes a directory traversal vulnerability in edit.php of the pheap application, where an attacker can supply a filename containing .. to read and modify arbitrary files. Affected component: pheap (edit.php). Root cause: improper validation of the filename parameter all...

CVE-2007-1140: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in edit.php in pheap allows remote attackers to read and modify arbitrary files via a .. dot dot in the filename parameter...

CVE-2007-0526: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Bitweaver 1.3.1 allow remote attackers to inject arbitrary web script or HTML via the URL PATHINFO to 1 articles/edit.php, 2 articles/list.php, 3 blogs/listblogs.php, or 4 blogs/rankings.php...

CVE-2006-6925: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in bitweaver 1.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the message title field when submitting an article to articles/edit.php, 2 the message title field when submitting a blog post to blogs/post.php, or...

CVE-2006-6016

wp-admin/user-edit.php in WordPress before 2.0.5 allows remote authenticated users to read the metadata of an arbitrary user via a modified userid parameter...

CVE-2006-6016

CVE-2006-6016 affects WordPress components prior to 2.0.5. A remote authenticated user can access the metadata of arbitrary users by modifying the user_id parameter on wp-admin/user-edit.php. The underlying issue exposes partial confidentiality and is triggered by insufficient access control for ...

CVE-2006-6016: Out-of-bounds Read

wp-admin/user-edit.php in WordPress before 2.0.5 allows remote authenticated users to read the metadata of an arbitrary user via a modified userid parameter...

[ECHO_ADV_55$2006]Phpmybibli <=2.1 Multiple Remote File Inclusion Vulnerability

ECHOADV55$2006 ------------------------------------------------------------------------ ----------------------- ECHOADV55$2006Phpmybibli =2.1 Multiple Remote File Inclusion Vulnerability ------------------------------------------------------------------------ ----------------------- Author : Dedi...

CVE-2006-5402: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in PHPmybibli 3.0.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the 1 classpath, 2 javascriptpath, and 3 includepath parameters in a cart.php; the 4 classpath parameter in b index.php; the 5 javascriptpath...

CVE-2006-4785: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in blog/edit.php in Moodle 1.6.1 and earlier allows remote attackers to execute arbitrary SQL commands via the format parameter as stored in the $blogEntry variable, which is not properly handled by the insertrecord function, which calls adodbcolumnsql in the adodb lay...