CVE-2006-6075

The CVE-2006-6075 entry describes a cross-site scripting (XSS) vulnerability in BaalAsp forum, specifically in addpost1.asp via the name parameter. The underlying issue is insufficient input handling that allows remote attackers to inject arbitrary script/HTML. CVSS v2 base score is 6.8 (Medium) ...

PT-2006-6735 · Baal · Baalasp Forum

Name of the Vulnerable Software and Affected Versions: BaalAsp forum affected versions not specified Description: The issue concerns multiple SQL injection vulnerabilities. These vulnerabilities allow remote attackers to execute arbitrary SQL commands. The vulnerabilities can be exploited through...

PT-2006-6734 · Baalasp · Baalasp Forum

Name of the Vulnerable Software and Affected Versions: BaalAsp forum affected versions not specified Description: The issue concerns multiple cross-site scripting XSS vulnerabilities in the addpost1.asp file of the BaalAsp forum. These vulnerabilities allow remote attackers to inject arbitrary we...

DeluxeBB sig.php远程文件包含漏洞

DeluxeBB是一款基于PHP的论坛程序。 DeluxeBB对用户请求的处理存在输入验证漏洞，远程攻击者可能利用此漏洞在服务器上以Web进程权限执行任意指令。 DeluxeBB的templates/deluxe/cp/sig.php脚本没有对templatefolder参数做充分的检查过滤，允许攻击者通过恶意参数串包含远程服务器上的脚本代码执行。 DeluxeBB DeluxeBB 1.09 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： DeluxeBB hotfixfor109.zip...

Powie's PHP Forum <= v1.29a (editpoll) Remote SQL Injection Exploit

============================================================================================== Powie's PHP Forum = v1.29a editpoll Remote SQL Injection Exploit =============================================================================================== Critical Level : Dangerous Venedor site :...

BaalAsp forum [login bypass ,injections sql(post), xss(post)]

vendor site:http://baalasp.com/ product:BaalAsp forum bug:login bypass, injection sql post, xss post risk:high authentification bypass : admin login bypass == /adminlogin.asp passwd: 'or''=' user login bypass == /userlogin.asp user: 'or''=' passwd: 'or''=' injection sql post == /search.asp...

baalasp.txt

vendor site:http://baalasp.com/ product:BaalAsp forum bug:login bypass, injection sql post, xss post risk:high authentification bypass : admin login bypass == /adminlogin.asp passwd: 'or''=' user login bypass == /userlogin.asp user: 'or''=' passwd: 'or''=' injection sql post == /search.asp...

Use the file header trick to get WebShell-vulnerability warning-the black bar safety net

Brother first timers,do not understand place,please Hai Han ! Administrator, boss,don't delete my posts ha...deleted before to consider your own safety haha. Purely a joke. Fee words not say more,start the chase ! Tomorrow to the exam,anyway, tomorrow exam hang a set,I also no longer do unnecessa...

minibb2-rfi.txt

Title : MiniBB Forum = 2 Remote File Include index.php Discovered By :::: ThE-LoRd-Of-CrAcKiNg MeHdi ------------------------------------------------------------------------ Sorce Code: http://www.minibb.net/download.php?file=minibb20 ----- Affected software description : Application : MiniBB For...

sunForumXSS.txt

Sun, in their amazing patheticness, have again allowed direct HTML to be written into their forum system. URL: http://forum.java.sun.com/forum.jspa?forumID=553 It works on only select forums, but due to severe incompetence from the administrators of the site, this issue will occur quit often. It ...

New Bug MiniBB Forum <= 2 Remote File Include (index.php)

Title : MiniBB Forum = 2 Remote File Include index.php Discovered By :::: ThE-LoRd-Of-CrAcKiNg MeHdi ------------------------------------------------------------------------ Sorce Code: http://www.minibb.net/download.php?file=minibb20 ----- Affected software description : Application : MiniBB For...

Update Protection against W-Agora 'inc_dir' Parameter Remote File Inclusion Vulnerabilities

W-Agora is an open source web publishing and forum software. It allows web administrators and their visitors to store and display messages, files, share discussions and other information on the web site. W-Agora is prone to multiple remote file inclusion vulnerabilities. An attacker can exploit...

portixSQL.txt

product:Portix-PHP vendor site :http://portix2.be risk : medium log with : username: 'or''=' passwd : 'or''=' xss post on the forum , vulnerable fields : titre auteur laurent gaffié & benjamin mossé http://s-a-p.ca/ contact: [email protected]...

Portix-PHP [login bypass & xss (post)]

product:Portix-PHP vendor site :http://portix2.be risk : medium log with : username: 'or''=' passwd : 'or''=' xss post on the forum , vulnerable fields : titre auteur laurent gaffiй & benjamin mossй http://s-a-p.ca/ contact: [email protected]...

CVE-2006-5802

SQL injection vulnerability in messagedetails.php in The Web Drivers Simple Forum, dated 20060318, allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2006-5802

SQL injection vulnerability in messagedetails.php in The Web Drivers Simple Forum, dated 20060318, allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2006-5802

The CVE-2006-5802 entry describes an SQL injection vulnerability in The Web Drivers Simple Forum, specifically in message_details.php. The vulnerability can be exploited by remote attackers via the id parameter to execute arbitrary SQL commands. The NVD summary confirms the flaw as a SQL injectio...

CVE-2006-5729

Yazd Discussion Forum before 3.0 beta does not properly manage forum permissions, which allows remote authenticated users to 1 reply to a message in an arbitrary forum, if authorized to create a message in any forum; and 2 perform certain unauthorized forum actions, related to an "error in how th...

CVE-2006-5729

Yazd Discussion Forum before 3.0 beta does not properly manage forum permissions, which allows remote authenticated users to 1 reply to a message in an arbitrary forum, if authorized to create a message in any forum; and 2 perform certain unauthorized forum actions, related to an "error in how th...

CVE-2006-5729

The CVE-2006-5729 entry concerns Yazd Discussion Forum prior to version 3.0 beta, where a mismanaged permission model allows remote authenticated users to (1) reply to a message in an arbitrary forum if they can create a message in any forum, and (2) perform certain unauthorized forum actions due...