Wsn (Multiple Products) - Local File Inclusion / Code Execution

Author: otmorozok428, http://forum.antichat.ru Products: Wsn Forum Enter to upload: http://www.site.com/forum/profile.php?action=editprofile&id=Your User ID See the avatar name at your profile. Upload evil avatar and go to: index.php?custom=yes&TID=../../attachments/avatars/Avatar...

phpwind任意修改管理员密码漏洞

PHPWind 论坛系统 是一套采用 php+mysql 数据库 方式运行并可生成 html 页面的全新且完善的强大系统。因具有非凡的访问速度和卓越的负载能力而深受国内外朋友的喜爱。但是80sec在其中发现了一个安全漏洞，成功利用此漏洞可以直接修改管理员的密码进入后台，取得管理员权限。...

Discuz!论坛wap功能模块编码的注射漏洞

Discuz!论坛系统是一个采用 PHP 和 MySQL 等其他多种数据库构建的高效论坛解决方案。Discuz! 在代码质量，运行效率，负载能力，安全等级，功能可操控性和权限严密性等方面都在广大用户中有良好的口碑 由于 PHP 对 多字节字符集的支持存在问题，在各种编码相互转换过程中，有可能引发程序溢出和程序错误 提交一个 ' 转意成 ' 然后转成gbk的，\和'就变成两个字符了 '就可以成功的引入 Discuz!4.0.0 Discuz!4.1.0 Discuz!5.0.0 Discuz!5.5.0 Discuz!6.0.0 Discuz!6.1.0...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Web Wiz Forum 9.5 allows remote attackers to log out a user via a link or IMG tag to logoffuser.asp...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Web Wiz Forum 9.5 allow remote attackers to inject arbitrary web script or HTML via the mode parameter to 1 admingroupdetails.asp and 2 admincategorydetails.asp...

CVE-2008-3392

Cross-site request forgery CSRF vulnerability in Web Wiz Forum 9.5 allows remote attackers to log out a user via a link or IMG tag to logoffuser.asp...

CVE-2008-3391

Multiple cross-site scripting XSS vulnerabilities in Web Wiz Forum 9.5 allow remote attackers to inject arbitrary web script or HTML via the mode parameter to 1 admingroupdetails.asp and 2 admincategorydetails.asp...

CVE-2008-3391

Multiple cross-site scripting XSS vulnerabilities in Web Wiz Forum 9.5 allow remote attackers to inject arbitrary web script or HTML via the mode parameter to 1 admingroupdetails.asp and 2 admincategorydetails.asp...

CVE-2008-3392

Cross-site request forgery CSRF vulnerability in Web Wiz Forum 9.5 allows remote attackers to log out a user via a link or IMG tag to logoffuser.asp...

CVE-2008-3391

CVE-2008-3391: Multiple cross-site scripting (XSS) vulnerabilities in Web Wiz Forum 9.5 allow remote attackers to inject arbitrary script/HTML via the mode parameter to admin_group_details.asp and admin_category_details.asp. Affected product is Web Wiz Forum 9.5; the underlying issue is XSS via u...

CVE-2008-3392

CVE-2008-3392 describes a cross-site request forgery vulnerability in Web Wiz Forum 9.5 that allows remote attackers to log out a user by visiting a crafted link or IMG tag to log_off_user.asp. The published data shows an attacker-authenticated–not required scenario (authentication: NONE) with im...

CVE-2008-3391: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Web Wiz Forum 9.5 allow remote attackers to inject arbitrary web script or HTML via the mode parameter to 1 admingroupdetails.asp and 2 admincategorydetails.asp...

CVE-2008-3392: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in Web Wiz Forum 9.5 allows remote attackers to log out a user via a link or IMG tag to logoffuser.asp...

PunBB多个远程跨站脚本漏洞

BUGTRAQ ID: 30396 CVECAN ID: CVE-2008-3336 PunBB是一款基于PHP的论坛程序。 PunBB的include/parser.php和moderate.php文件没有正确地验证某些参数便返回给了用户，远程攻击者可以通过向论坛提交恶意请求执行脚本注入或跨站脚本攻击。 PunBB 1.x PunBB ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://punbb.informer.com/download/punbb-1.2.19.tar.gz...

MyBB search.php文件跨站脚本执行漏洞

BUGTRAQ ID: 30401 CVECAN ID: CVE-2008-3334 MyBB是一款流行的Web论坛程序。 MyBB的search.php文件没有正确地验证某些参数便返回给了用户，远程攻击者可以通过向论坛提交恶意请求执行脚本注入或跨站脚本攻击。 MyBB 1.2.x MyBB ---- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.mybboard.net/download/latest...

Geeklog Forum Plugin vulnerable to cross-site scripting

Overview Geeklog Forum Plugin contains a cross-site scripting vulnerability. Geeklog Forum Plugin is a plugin for Geeklog, an open source contents management system. Geeklog Forum Plugin contains a cross-site scripting vulnerability. NetAgent Co., Ltd. reported this vulnerability to IPA. JPCERT/C...

Web Wiz Forum 9.5 - 'admin_group_details.asp?mode' Cross-Site Scripting

source: https://www.securityfocus.com/bid/30398/info Web Wiz Forums is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in...

Unfixed XSS vulnerability at www.xgn.com.au

Security researcher doublecheck, has submitted on 27/07/2008 a cross-site-scripting XSS vulnerability affecting www.xgn.com.au, which at the time of submission ranked 3589812 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 17/06/2009. It is...

IceBB <= 1.0-RC9.2 Blind SQL Injection / Session Hijacking Exploit

No description provided by source. Author: GiReX 26/07/08 Homepage: girex.altervista.org CMS: IceBB = 1.0-RC9.2 Site: icebb.net Bug: Blind SQL Injection Exploit: Session Hijacking PoC Works regardless of php.ini settings Description: IceBB is a powerful, fast, free, and open-source forum solution...

The big data library default address-vulnerability warning-the black bar safety net

data/dvbbs7. mdb Action Network Forum database /databackup/dvbbs7. mdb Action Network Forum database /bbs/databackup/dvbbs7. mdb Action Network Forum database /admin/data/qcdnnews. mdb green to create article management system database /data/qcdnnews. mdb green to create article management system...