7907 matches found
CVE-2009-2327
Cross-site scripting XSS vulnerability in addvoting.php in KerviNet Forum 1.1 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the vvariant1 parameter...
CVE-2009-2329
KerviNet Forum 1.1 and earlier allows remote attackers to obtain sensitive information via a direct request to 1 admin/head.php, or 2 votingdiagram.php, 3 voting.php, 4 topicssearch.php, 5 topicslist.php, 6 toppart.php, 7 quicksearch.php, 8 quickreply.php, 9 modermenu.php, 10 messageslist.php, 11...
CVE-2007-6727
The CVE-2007-6727 entry describes a SQL injection in KerviNet Forum 1.1, specifically topic.php, where the parameter forum can be exploited to execute arbitrary SQL commands remotely. This is the underlying vulnerability: improper sanitization/parameter handling in the forum parameter leading to ...
CVE-2009-2327
CVE-2009-2327 affects KerviNet Forum 1.1 and earlier. The vulnerability is a Cross-site Scripting (XSS) flaw in add_voting.php, exploitable via the v_variant1 parameter. The issue allows remote authenticated users to inject arbitrary web script or HTML. Documents consistently describe the same ve...
CVE-2009-2329
CVE-2009-2329 affects KerviNet Forum 1.1 and earlier. The vulnerability enables remote attackers to disclose sensitive information by directly requesting any of 16 include_files/ PHP files (admin/head.php, voting_diagram.php, voting.php, topics_search.php, topics_list.php, top_part.php, quick_sea...
CVE-2009-2326
CVE-2009-2326 describes multiple SQL injection vulnerabilities in KerviNet Forum 1.1 and earlier. The weaknesses allow remote attackers to execute arbitrary SQL commands via two confirmed vectors: (1) an enter_parol cookie to index.php in an auto action, and (2) the topic parameter to message.php...
CVE-2009-2328
CVE-2009-2328 affects KerviNet Forum versions 1.1 and earlier. The issue is in admin/edit_user.php which does not require administrative authentication, enabling remote attackers to delete arbitrary user accounts and perform SQL injection via the del_user_id parameter. The available connected doc...
CVE-2009-2327: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in addvoting.php in KerviNet Forum 1.1 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the vvariant1 parameter...
CVE-2009-2328: Improper Authentication
admin/edituser.php in KerviNet Forum 1.1 and earlier does not require administrative authentication, which allows remote attackers to delete arbitrary accounts and conduct SQL injection attacks via the deluserid parameter...
CVE-2007-6727: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in topic.php in KerviNet Forum 1.1 allows remote attackers to execute arbitrary SQL commands via the forum parameter...
CVE-2009-2326: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL injection vulnerabilities in KerviNet Forum 1.1 and earlier allow remote attackers to execute arbitrary SQL commands via 1 an enterparol cookie to index.php in an auto action or 2 the topic parameter to message.php. NOTE: vector 2 can be leveraged for a cross-site scripting XSS attac...
CVE-2009-2329: Exposure of Sensitive Information to an Unauthorized Actor
KerviNet Forum 1.1 and earlier allows remote attackers to obtain sensitive information via a direct request to 1 admin/head.php, or 2 votingdiagram.php, 3 voting.php, 4 topicssearch.php, 5 topicslist.php, 6 toppart.php, 7 quicksearch.php, 8 quickreply.php, 9 modermenu.php, 10 messageslist.php, 11...
KerviNet Forum 1.1 SQL Injection / XSS
dork: "Copyright KerviNet" eLwauxc 20.06.2009 Blind SQLinj /index.php ------------------------------------------------------------------------------------------------- if$COOKIE'userenter'=="auto" $enterlogin=$COOKIE'enterlogin'; $enterparol=$COOKIE'enterparol'; $mysql-query"SELECT name, pass,...
KerviNet Forum <= 1.1 Multiple Remote Vulnerabilities
Exploit for unknown platform in category web applications ===================================================== KerviNet Forum query"SELECT name, pass, status FROM users WHERE name = '".$enterlogin."' AND pass = '".$enterparol."'";...
kervinet forum 1.1 - Multiple Vulnerabilities
kervinet forum 1.1 - Multiple Vulnerabilities dork: "Copyright KerviNet" eLwauxc 20.06.2009 Blind SQLinj /index.php ------------------------------------------------------------------------------------------------- if$COOKIE'userenter'=="auto" $enterlogin=$COOKIE'enterlogin';...
drupal -- multiple vulnerabilities
The Drupal Security Team reports: Cross-site scripting The Forum module does not correctly handle certain arguments obtained from the URL. By enticing a suitably privileged user to visit a specially crafted URL, a malicious user is able to insert arbitrary HTML and script code into forum pages...
KerviNet Forum <= 1.1 Multiple Remote Vulnerabilities
No description provided by source. dork: "Copyright KerviNet" eLwauxc 20.06.2009 Blind SQLinj /index.php ------------------------------------------------------------------------------------------------- if$COOKIE'userenter'=="auto" $enterlogin=$COOKIE'enterlogin'; $enterparol=$COOKIE'enterparol';...
kervinet forum 1.1 - Multiple Vulnerabilities
dork: "Copyright KerviNet" eLwauxc 20.06.2009 Blind SQLinj /index.php ------------------------------------------------------------------------------------------------- if$COOKIE'userenter'=="auto" $enterlogin=$COOKIE'enterlogin'; $enterparol=$COOKIE'enterparol'; $mysql-query"SELECT name, pass,...
PHPEcho CMS 2.0-rc3 Cross Site Scripting
PHPEcho CMS 2.0-rc3 forum XSS Cookie Stealing / Blind Vulnerability bug found by Jose Luis Gongora Fernandez a.k.a JosS contact: sys-projectathotmail.com website: http://www.hack0wn.com/ - download: http://sourceforge.net/project/showfiles.php?groupid=186100 XSS The forum allowed insert javascrip...
PHPEcho CMS 2.0-rc3 - 'forum' Cross-Site Scripting Cookie Stealing / Blind SQL Injection
PHPEcho CMS 2.0-rc3 forum XSS Cookie Stealing / Blind Vulnerability bug found by Jose Luis Gongora Fernandez a.k.a JosS contact: sys-projectathotmail.com website: http://www.hack0wn.com/ - download: http://sourceforge.net/project/showfiles.php?groupid=186100 XSS The forum allowed insert javascrip...