CVE-2008-6104: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in A4Desk PHP Event Calendar allows remote attackers to execute arbitrary SQL commands via the eventid parameter to admin/index.php...

a4desk-sqldisclose.txt

. . | / | | \ \ | / / |\ \ \ |/ // / /\ \ / |/ \ / // | / | | / \ /|\ / / / / \ / \ / / / \ | | /\ /\ / \ | \ // est.2007 / / forum.darkc0de.com --d3hydr8 -rsauron-baltazar -sinner01 -C1c4Tr1Z - beenu -Marezzi-P47tr1ck- FeDeReR -MAGE -JeTFyrE- DON-Outlawz and all darkc0de and...

A4Desk Event Calendar - 'eventid' SQL Injection

source: https://www.securityfocus.com/bid/33835/info A4Desk Event Calendar is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access o...

a4deskphp-rfi.txt

================================================================= ========A4Desk PHP Event Calendar Remote File Inclusion======== ================================================================= Vendor: WebUnion Media Ltd Vendor Site: http://php.a4desk.com/calendar/ Date Discovered: 9-29-08...

A4Desk Event Calendar - v Remote File Inclusion

A4Desk Event Calendar - v Remote File Inclusion source: https://www.securityfocus.com/bid/31507/info A4Desk Event Calendar is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue may allow an attacker to compromise the...

A4Desk Event Calendar - 'v' Remote File Inclusion

source: https://www.securityfocus.com/bid/31507/info A4Desk Event Calendar is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attac...

ducalendar-sql.txt

DUcalendar v 1.0 detail.asp?iEve= Remote SQL Inection Exploit + Script : DUcalendar + Version : 1.0 Maybe others + Exploit : Remote SQL Injection + Script URL : http://www.codedworld.com/download/ducalendar-/545.html + Description : 'Free Event Calendar written in ASP. Features include unlimited...

DUcalendar 1.0 (detail.asp iEve) Remote SQL Injection Vulnerability

Exploit for unknown platform in category web applications =================================================================== DUcalendar 1.0 detail.asp iEve Remote SQL Injection Vulnerability =================================================================== DUcalendar v 1.0 detail.asp?iEve=...

Carbon Communities forum Multiple Vulnerabilities.

www.BugReport.ir AmnPardaz Security Research Team Title: Multiple Vulnerabilities in Carbon Communities forum. Vendor: www.carboncommunities.com Vulnerable Version: 2.4 and prior versions Exploit: Available Impact: High Fix: N/A Original Advisory: http://bugreport.ir/index.php?/35 1. Description:...

Cross site scripting

Cross-site scripting XSS vulnerability in modules/ecal/display.php in the Event Calendar in bcoos 1.0.10 allows remote attackers to inject arbitrary web script or HTML via the month parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

CVE-2007-6365

Cross-site scripting XSS vulnerability in modules/ecal/display.php in the Event Calendar in bcoos 1.0.10 allows remote attackers to inject arbitrary web script or HTML via the month parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

CVE-2007-6365

CVE-2007-6365 describes a cross-site scripting (XSS) vulnerability in the Event Calendar component of bcoos 1.0.10, specifically in modules/ecal/display.php, where an attacker can inject arbitrary script or HTML via the month parameter. The affected product is bcoos 1.0.10; the issue is a client-...

CVE-2007-6365

Cross-site scripting XSS vulnerability in modules/ecal/display.php in the Event Calendar in bcoos 1.0.10 allows remote attackers to inject arbitrary web script or HTML via the month parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

CVE-2007-6365: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in modules/ecal/display.php in the Event Calendar in bcoos 1.0.10 allows remote attackers to inject arbitrary web script or HTML via the month parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in modules/ecal/display.php in the Event Calendar in bcoos 1.0.10 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 day or 2 year parameter...

CVE-2007-6274

Multiple cross-site scripting XSS vulnerabilities in modules/ecal/display.php in the Event Calendar in bcoos 1.0.10 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 day or 2 year parameter...

CVE-2007-6274

CVE-2007-6274 describes multiple cross-site scripting (XSS) vulnerabilities in the Event Calendar module ec al/display.php for the product family/bcoos, affecting versions 1.0.10 and earlier. The flaw allows remote attackers to inject arbitrary web script or HTML by manipulating the (1) day or (2...

CVE-2007-6274

Multiple cross-site scripting XSS vulnerabilities in modules/ecal/display.php in the Event Calendar in bcoos 1.0.10 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 day or 2 year parameter...

CVE-2007-6274: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in modules/ecal/display.php in the Event Calendar in bcoos 1.0.10 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 day or 2 year parameter...

simpnews24103-xss.txt

netVigilance Security Advisory 70 SimpNews version 2.41.03 Multiple XSS Attack Vulnerabilities Description: SimpNews is a news system written in PHP. Features: Data stored in MySQL, admin interface, support for multiple languages, support for multiple instances in one database, own header, multip...