iScripts EasyCreate CMS v2.0 - Multiple Web Vulnerabilites

Title: ====== iScripts EasyCreate CMS v2.0 - Multiple Web Vulnerabilites Date: ===== 2012-06-02 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=588 VL-ID: ===== 588 Common Vulnerability Scoring System: ==================================== 8.3 Introduction: =============...

Viscacha 0.8.1 XSS / SQL Injection / Path Disclosure

================================== Vulnerability ID: HTB22921 Reference: http://www.htbridge.ch/advisory/sqlinjectioninviscacha.html Product: Viscacha Vendor: MaMo Net http://www.viscacha.org Vulnerable Version: 0.8.1 Vendor Notification: 24 March 2011 Vulnerability Type: SQL Injection Risk level...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in editprofile.php in Viscacha 0.8 Gold allow remote authenticated users to inject arbitrary web script or HTML via the 1 skype, 2 yahoo, 3 aol, 4 msn, or 5 jabber parameter in a profile2 action. NOTE: some of these details are obtained from third...

CVE-2009-4567

Viscacha 0.8 Gold is affected by multiple XSS vulnerabilities in editprofile.php (profile2 action). Specifically, the parameters (1) skype, (2) yahoo, (3) aol, (4) msn, and (5) jabber can be abused to inject arbitrary web script/HTML. The issue is exploitable by remote authenticated users, but th...

CVE-2009-4567: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in editprofile.php in Viscacha 0.8 Gold allow remote authenticated users to inject arbitrary web script or HTML via the 1 skype, 2 yahoo, 3 aol, 4 msn, or 5 jabber parameter in a profile2 action. NOTE: some of these details are obtained from third...

CVE-2008-6188: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in people/editprofile.php in Gforge 4.6 rc1 and earlier allows remote attackers to execute arbitrary SQL commands via the skilledit parameter...

CVE-2007-4966: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in www/people/editprofile.php in GForge 4.6b2 and earlier allows remote attackers to execute arbitrary SQL commands via the skilldelete parameter...

CVE-2006-4881

Multiple cross-site scripting XSS vulnerabilities in David Bennett PHP-Post PHPp 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the replyuser parameter in a pm.php; 2 the txtjumpto parameter in b dropdown.php; the 3 txterror and 4 txttemplatenotexist parameter...

CVE-2006-4881: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in David Bennett PHP-Post PHPp 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the replyuser parameter in a pm.php; 2 the txtjumpto parameter in b dropdown.php; the 3 txterror and 4 txttemplatenotexist parameter...

CVE-2006-3983

PHP remote file inclusion vulnerability in editprofile.php in phpReactor 1.27pl1 allows remote attackers to execute arbitrary PHP code via a URL in the pathtohomedir parameter...

CVE-2006-3983

CVE-2006-3983 : In php(Reactor) 1.27pl1, the editprofile.php component contains a remote file inclusion issue that allows remote attackers to execute arbitrary PHP code by supplying a URL in the pathtohomedir parameter. The connected documents confirm the vulnerability and the injection vector bu...

CVE-2006-3983

PHP remote file inclusion vulnerability in editprofile.php in phpReactor 1.27pl1 allows remote attackers to execute arbitrary PHP code via a URL in the pathtohomedir parameter...

CVE-2006-3983: Undefined Security Weakness

PHP remote file inclusion vulnerability in editprofile.php in phpReactor 1.27pl1 allows remote attackers to execute arbitrary PHP code via a URL in the pathtohomedir parameter...

PhpReactor 1.2.7pl1 - pathtohomedir Remote File Inclusion

PhpReactor 1.2.7pl1 - pathtohomedir Remote File Inclusion www.system-defacers.org Found By CeNGiZ-HaN [email protected] phpreactor 1.2.7 pl 1 pathtohomedir inclusion vulnerability Vulnerable Code in editprofile.php //INCLUDE DB FUNCTIONS if!defined"REACTORINCDB"...

PhpReactor 1.2.7pl1 (pathtohomedir) Remote Inclusion Vulnerability

Exploit for unknown platform in category web applications ================================================================== PhpReactor 1.2.7pl1 pathtohomedir Remote Inclusion Vulnerability ================================================================== phpreactor 1.2.7 pl 1 pathtohomedir...

PhpReactor 1.2.7pl1 (pathtohomedir) Remote Inclusion Vulnerability

No description provided by source. www.system-defacers.org Found By CeNGiZ-HaN [email protected] phpreactor 1.2.7 pl 1 pathtohomedir inclusion vulnerability Vulnerable Code in editprofile.php //INCLUDE DB FUNCTIONS if!defined"REACTORINCDB" include$pathtohomedir."/inc/db.inc.php";...

CVE-2005-4138

Multiple cross-site scripting XSS vulnerabilities in ThWboard before 3 Beta 2.84 allow remote attackers to inject arbitrary web script or HTML via the 1 Wohnort and 2 Beruf fields in editprofile.php, 3 user parameter array in vprofile.php, and 4 the action parameter in misc.php...

CVE-2005-4138

ThWboard vulnerable to multiple XSS flaws in versions before 3 Beta 2.84. Attack vectors include (1) Wohnort and (2) Beruf fields in editprofile.php, (3) user parameter array in v_profile.php, and (4) the action parameter in misc.php. These allow remote attackers to inject arbitrary web script/HT...

CVE-2005-4138: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in ThWboard before 3 Beta 2.84 allow remote attackers to inject arbitrary web script or HTML via the 1 Wohnort and 2 Beruf fields in editprofile.php, 3 user parameter array in vprofile.php, and 4 the action parameter in misc.php...

CVE-2004-1863: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in XMB aka extreme message board 1.9 beta aka Nexus beta allow remote attackers to inject arbitrary web script or HTML via 1 the u2uheader parameter in editprofile.php, the restrict parameter in 2 member.php, 3 misc.php, and 4 today.php, and 5 an...