CVE-2008-6420

Social Site Generator SSG 2.0 allows remote attackers to read arbitrary files via the file parameter to 1 filedload.php, 2 webadmin/download.php, and 3 webadmin/downloadfile.php...

CVE-2008-6420

The CVE-2008-6420 entry concerns Social Site Generator (SSG) 2.0. The vulnerability allows remote attackers to read arbitrary files via the file parameter to (1) filedload.php, (2) webadmin/download.php, and (3) webadmin/download_file.php. The impact is described as partial confidentiality leakag...

CVE-2008-6420

Social Site Generator SSG 2.0 allows remote attackers to read arbitrary files via the file parameter to 1 filedload.php, 2 webadmin/download.php, and 3 webadmin/downloadfile.php...

Directory traversal

Directory traversal vulnerability in gallery/comment.php in Enhanced Simple PHP Gallery ESPG 1.72 allows remote attackers to read arbitrary files via a .. dot dot in the file parameter. NOTE: the vulnerability may be in my little homepage Comment script. If so, then this should not be treated as ...

CVE-2009-0331: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in gallery/comment.php in Enhanced Simple PHP Gallery ESPG 1.72 allows remote attackers to read arbitrary files via a .. dot dot in the file parameter. NOTE: the vulnerability may be in my little homepage Comment script. If so, then this should not be treated as ...

Design/Logic Flaw

globsyedit.php in Globsy 1.0 and earlier allows remote attackers to create or overwrite arbitrary files via a filename in the file parameter and file contents in the data parameter...

Directory traversal

Directory traversal vulnerability in backend/template.php in Constructr CMS 3.02.5 and earlier, when registerglobals is enabled and magicquotesgpc is disabled, allows remote attackers to create or read arbitrary files via directory traversal sequences in the editfile parameter...

Directory traversal

Directory traversal vulnerability in mod.php in Arab Portal 2.1 on Windows allows remote attackers to read arbitrary files via a .. dot dot in the file parameter, in conjunction with a show action...

CVE-2008-5787

Directory traversal vulnerability in mod.php in Arab Portal 2.1 on Windows allows remote attackers to read arbitrary files via a .. dot dot in the file parameter, in conjunction with a show action...

CVE-2008-5787: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in mod.php in Arab Portal 2.1 on Windows allows remote attackers to read arbitrary files via a .. dot dot in the file parameter, in conjunction with a show action...

CVE-2008-4873

board.cgi in Sepal SPBOARD 4.5 allows remote attackers to execute arbitrary commands via shell metacharacters in the file parameter during a downfile action...

CVE-2008-4873: Undefined Security Weakness

board.cgi in Sepal SPBOARD 4.5 allows remote attackers to execute arbitrary commands via shell metacharacters in the file parameter during a downfile action...

CVE-2008-3124: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in Mole Group Hotel Script 1.0 allows remote attackers to execute arbitrary SQL commands via the file parameter...

CVE-2008-2462: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the viewfile documentation command in Caucho Resin before 3.0.25, and 3.1.x before 3.1.4, allows remote attackers to inject arbitrary web script or HTML via the file parameter...

CVE-2008-2878: Undefined Security Weakness

Open redirect vulnerability in rssgetfile.php in Academic Web Tools AWT YEKTA 1.4.3.1, and 1.4.2.8 and earlier, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the file parameter...

CVE-2008-2842

Cross-site scripting XSS vulnerability in edit/showmedia.asp in doITLive CMS 2.50 and earlier allows remote attackers to inject arbitrary web script or HTML via the FILE parameter...

CVE-2008-2842

Cross-site scripting XSS vulnerability in edit/showmedia.asp in doITLive CMS 2.50 and earlier allows remote attackers to inject arbitrary web script or HTML via the FILE parameter...

CVE-2008-2842: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in edit/showmedia.asp in doITLive CMS 2.50 and earlier allows remote attackers to inject arbitrary web script or HTML via the FILE parameter...

CVE-2008-2350: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in highlight.php in bcoos 1.0.9 through 1.0.13 allows remote attackers to read arbitrary files via 1 .. dot dot or 2 C: folder sequences in the file parameter...

CVE-2008-2198: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in kmitaadmin/kmitat/htmlcode.php in Kmita Tellfriend 2.0 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the file parameter...