[SA18268] phpBook "email" PHP Code Injection Vulnerability

TITLE: phpBook "email" PHP Code Injection Vulnerability SECUNIA ADVISORY ID: SA18268 VERIFY ADVISORY: http://secunia.com/advisories/18268/ CRITICAL: Highly critical IMPACT: System access WHERE: From remote SOFTWARE: phpBook 1.x http://secunia.com/product/6719/ DESCRIPTION: Aliaksandr Hartsuyeu ha...

CVE-2005-4597

Cross-site scripting XSS vulnerability in index.php in iPei Guestbook 1.7 allows remote attackers to inject arbitrary web script or HTML via the email parameter, as used by the email field, when signing a guestbook...

CVE-2005-4597: Undefined Security Weakness

Cross-site scripting XSS vulnerability in index.php in iPei Guestbook 1.7 allows remote attackers to inject arbitrary web script or HTML via the email parameter, as used by the email field, when signing a guestbook...

CVE-2005-4597

Cross-site scripting XSS vulnerability in index.php in iPei Guestbook 1.7 allows remote attackers to inject arbitrary web script or HTML via the email parameter, as used by the email field, when signing a guestbook...

CVE-2002-2193

Cross-site scripting XSS vulnerability in mojo.cgi for Mojo Mail 2.7 allows remote attackers to inject arbitrary web script via the email parameter...

CVE-2002-2193: Undefined Security Weakness

Cross-site scripting XSS vulnerability in mojo.cgi for Mojo Mail 2.7 allows remote attackers to inject arbitrary web script via the email parameter...

CVE-2005-2476

Cross-site scripting XSS vulnerability in lostpassowrd.php in Naxtor Shopping Cart 1.0 allows remote attackers to inject arbitrary web script or HTML via the email parameter...

CVE-2005-2476

Cross-site scripting XSS vulnerability in lostpassowrd.php in Naxtor Shopping Cart 1.0 allows remote attackers to inject arbitrary web script or HTML via the email parameter...

CVE-2005-2476: Undefined Security Weakness

Cross-site scripting XSS vulnerability in lostpassowrd.php in Naxtor Shopping Cart 1.0 allows remote attackers to inject arbitrary web script or HTML via the email parameter...

CVE-2005-2190

CVE-2005-2190 concerns multiple SQL injection flaws in Comersus Shop Cart. Remote attackers can inject via (1) email to comersus_optAffiliateRegistrationExec.asp or (2) idProduct to comersus_optReviewReadExec.asp, potentially executing arbitrary SQL on the database. The NVD notes a Base Score of ...

CVE-2002-1799

CVE-2002-1799 concerns Cross-site Scripting in phpRank 1.8. The vulnerability allows remote attackers to inject arbitrary script/HTML via two user-supplied parameters: email (to add.php) and banurl. The connected documents do not provide vendor-specific patches or versioned remediation; no exploi...

CVE-2002-1799: Undefined Security Weakness

Cross-site scripting XSS vulnerability in phpRank 1.8 allows remote attackers to inject arbitrary web script or HTML via the 1 email parameter to add.php or 2 banurl parameter...

CVE-2005-1784

Hosting Controller 6.1 HotFix 2.0 and earlier allows remote attackers to steal passwords and gain privileges via a modified emailaddress parameter in an updateprofile action for UserProfile.asp...

CVE-2005-1652

CVE-2005-1652 affects Woppoware PostMaster 4.2.2 (build 3.2.5). Affected component: message.htm. Root cause: remote authentication bypass via modification of the email parameter, enabling attackers to bypass login and act as the targeted user (e.g., read messages, compose messages). Public refere...

CVE-2005-1652: Undefined Security Weakness

message.htm for Woppoware PostMaster 4.2.2 build 3.2.5 allows remote attackers to bypass authentication by modifying the email parameter...

CVE-2005-1653: Undefined Security Weakness

Cross-site scripting XSS vulnerability in message.htm for Woppoware PostMaster 4.2.2 build 3.2.5 allows remote attackers to inject arbitrary web script or HTML via the email parameter...

PT-2005-2178 · Oneworld · Oneworldstore

Name of the Vulnerable Software and Affected Versions: OneWorldStore affected versions not specified Description: The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The affected parameters and...

CVE-2005-0818: Undefined Security Weakness

Cross-site scripting XSS vulnerability in PunBB 1.2.3 allows remote attackers to inject arbitrary web script or HTML via the 1 email or 2 Jabber parameters...

Multiple vulns in punBB

================================================= SQL Injections in punbb-1.2.1 register.php ================================================= Description ----------- A remote attacker can cause register.php to execute arbitrary SQL statements by supplying malicous values to the language or email...

MySQL Eventum index.php email Parameter XSS

The MySQL Eventum install hosted on the remote web server is vulnerable to a cross-site scripting attack because it fails to sanitize user-supplied input to the 'email' parameter of the 'index.php' script before using it to generate dynamic HTML output. With a specially crafted URL, an attacker c...