Web Wiz Forum 6.34 - Information Disclosure

source: https://www.securityfocus.com/bid/7380/info Web Wiz Forum has been reported prone to sensitive information disclosure vulnerability. An attacker may make a request for and download the underlying Access database file that is used by the Forum application. Sensitive information that is...

Web Wiz Forum 6.34 - Information Disclosure

Web Wiz Forum 6.34 - Information Disclosure source: https://www.securityfocus.com/bid/7380/info Web Wiz Forum has been reported prone to sensitive information disclosure vulnerability. An attacker may make a request for and download the underlying Access database file that is used by the Forum...

XMB < 1.9.1 Multiple XSS

The remote host is running XMB Forum, a web forum written in PHP. The version of XMB installed on the remote host is affected by several cross-site scripting issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

PHP-Nuke block-Forums.php subject vulnerabilities

The block-Forums.php file have a vuln if an attacker insert a malformatted subject to a topic of Splatt Forum. A type of subject is: "scriptalert'bug'";/script The 'alt' tag is closed by " and the other text is normal html. This bug is very bad if a subject is:...

PHP-Nuke 6.0/6.5 Forum Module - 'viewforum.php' SQL Injection

source: https://www.securityfocus.com/bid/7194/info It has been reported that an input validation error exists in the 'viewforum.php' script included with PHPNuke as part of the Forum module. Because of this, an attacker could send a malicious string through PHPNuke that would allow the attacker ...

PHP-Nuke 6.0/6.5 Forum Module - 'viewtopic.php' SQL Injection

source: https://www.securityfocus.com/bid/7193/info It has been reported that an input validation error exists in the 'viewtopic.php' script included with PHPNuke as part of the Forum module. Because of this, an attacker could send a malicious string through PHPNuke that would allow the attacker ...

PHP-Nuke 6.06.5 Forum Module - viewforum.php SQL Injection

PHP-Nuke 6.06.5 Forum Module - viewforum.php SQL Injection source: https://www.securityfocus.com/bid/7194/info It has been reported that an input validation error exists in the 'viewforum.php' script included with PHPNuke as part of the Forum module. Because of this, an attacker could send a...

PHP-Nuke 6.06.5 Forum Module - viewtopic.php SQL Injection

PHP-Nuke 6.06.5 Forum Module - viewtopic.php SQL Injection source: https://www.securityfocus.com/bid/7193/info It has been reported that an input validation error exists in the 'viewtopic.php' script included with PHPNuke as part of the Forum module. Because of this, an attacker could send a...

CVE-2002-1457

CVE-2002-1457 targets L-Forum 2.40. It describes a SQL injection in search.php via the search parameter that could allow remote attackers to execute arbitrary SQL statements. The connected documents confirm the affected software (L-Forum 2.40) and the vulnerable component (search.php) with the un...

CVE-2002-1458

CVE-2002-1458 is a cross-site scripting vulnerability in L-Forum 2.40 and earlier when the option “Enable HTML in messages” is enabled. The vulnerability allows remote attackers to inject arbitrary script or HTML via message fields such as From, E-Mail, Subject, and Body . The NVD entry assigns a...

CVE-2002-1459

CVE-2002-1459 is a cross-site scripting vulnerability in L-Forum versions 2.40 and earlier, where the option “Enable HTML in messages” off allows remote insertion of script/HTML via From, E‑Mail, or Subject fields. Root cause: insufficient input validation/escaping in message fields. According to...

CVE-2002-1460

CVE-2002-1460 affects L-Forum 2.40 and earlier. The issue is improper verification of uploaded files and associated POST variables (attachment, attachment_name, attachment_size, attachment_type), enabling remote attackers to read arbitrary files. The connected documents confirm the affected softw...

CVE-2002-1457

SQL injection vulnerability in search.php for L-Forum 2.40 allows remote attackers to execute arbitrary SQL statements via the search parameter...

CVE-2002-1458

Cross-site scripting vulnerability in L-Forum 2.40 and earlier, when the "Enable HTML in messages" option is on, allows remote attackers to insert arbitrary script or HTML via message fields including 1 From, 2 E-Mail, 3 Subject and 4 Body...

CVE-2002-1459

Cross-site scripting vulnerability in L-Forum 2.40 and earlier, when the "Enable HTML in messages" option is off, allows remote attackers to insert arbitrary script or HTML via message fields including 1 From, 2 E-Mail, and 3 Subject...

CVE-2002-1460

L-Forum 2.40 and earlier does not properly verify whether a file was uploaded or if the associated variables were set by POST attachment, attachmentname, attachmentsize and attachmenttype, which allows remote attackers to read arbitrary files...

CVE-2002-1457: Undefined Security Weakness

SQL injection vulnerability in search.php for L-Forum 2.40 allows remote attackers to execute arbitrary SQL statements via the search parameter...

CVE-2002-1459: Undefined Security Weakness

Cross-site scripting vulnerability in L-Forum 2.40 and earlier, when the "Enable HTML in messages" option is off, allows remote attackers to insert arbitrary script or HTML via message fields including 1 From, 2 E-Mail, and 3 Subject...

CVE-2002-1460: Undefined Security Weakness

L-Forum 2.40 and earlier does not properly verify whether a file was uploaded or if the associated variables were set by POST attachment, attachmentname, attachmentsize and attachmenttype, which allows remote attackers to read arbitrary files...

CVE-2002-1458: Undefined Security Weakness

Cross-site scripting vulnerability in L-Forum 2.40 and earlier, when the "Enable HTML in messages" option is on, allows remote attackers to insert arbitrary script or HTML via message fields including 1 From, 2 E-Mail, 3 Subject and 4 Body...