CVE-2006-6028

Directory traversal vulnerability in textview.php in Anton Vlasov DoSePa 1.0.4 allows remote attackers to read arbitrary files via a .. dot dot sequence or absolute file path in the file parameter...

PT-2006-6675 · Dosepa · Dosepa

Name of the Vulnerable Software and Affected Versions: DoSePa version 1.0.4 Description: A directory traversal issue exists, allowing remote attackers to read arbitrary files. This is achieved by using a .. dot dot sequence or absolute file path in the file parameter. Recommendations: For version...

CVE-2006-4081

previewemail.cgi in Barracuda Spam Firewall BSF 3.3.01.001 through 3.3.03.053 allows remote attackers to execute commands via shell metacharacters "|" pipe symbol in the file parameter. NOTE: the attack can be extended to arbitrary commands by the presence of CVE-2006-4000...

CVE-2006-3737

Cross-site scripting XSS vulnerability in filemanager/filemanager.php in the control panel in SWsoft Plesk 8.0 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the file parameter...

CVE-2006-2437

The CVE-2006-2437 entry concerns Caucho Resin’s viewfile servlet in the Resin documentation package (resin-doc) for versions 3.0.17 and 3.0.18. The available sources in the connected documents describe an arbitrary file disclosure: an unauthenticated remote attacker can obtain the contents of fil...

Directory traversal

Directory traversal vulnerability in help/index.php in X7 Chat 2.0 and earlier allows remote attackers to include arbitrary files via .. dot dot sequences in the helpfile parameter...

Coppermine Photo Gallery index.php file Parameter Local File Inclusion

The version of Coppermine Gallery installed on the remote host fails to properly sanitize input to the 'file' parameter of the 'index.php' script before using it in a PHP 'includeonce' function. Regardless of PHP's 'registerglobals' setting, an unauthenticated attacker may be able to exploit this...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in bol.cgi in BlankOL 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 file or 2 function parameter...

DEBIAN-CVE-2006-0626

SQL injection vulnerability in spipaccesdoc.php3 in SPIP 1.8.2g and earlier allows remote attackers to execute arbitrary SQL commands via the file parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in throw.main in Outblaze allows remote attackers to inject arbitrary web script or HTML via the file parameter...

CVE-2005-3676

SQL injection vulnerability in download.php in PhpWebThings 1.4.4 allows remote attackers to execute arbitrary SQL commands via the file parameter...

CVE-2005-3676

SQL injection vulnerability in download.php in PhpWebThings 1.4.4 allows remote attackers to execute arbitrary SQL commands via the file parameter...

CVE-2005-2786

Directory traversal vulnerability in bestmailedit.cgi in cosmoshop 8.10.78 and earlier allows remote administrators to read arbitrary files via ".." sequences in the file parameter...

CVE-2004-2347

blog.cgi in Leif M. Wright Web Blog 1.1 and 1.1.5 allows remote attackers to execute arbitrary commands via shell metacharacters such as '|' in the file parameter of ViewFile requests...

CVE-2002-2011

The CVE-2002-2011 entry concerns Faq-O-Matic’s fom.cgi (versions 2.711 and 2.712). The issue is a cross-site scripting (XSS) vulnerability where an attacker can inject arbitrary web script or HTML via the file parameter, potentially enabling/script execution in the victim’s browser. Documented im...

CVE-2005-2111

login.cgi in Community Link Pro Web Editor allows remote attackers to execute arbitrary commands via the file parameter...

CVE-2005-2111

The OpenVAS/Nessus entries confirm CVE-2005-2111 affects Community Link Pro Web Editor’s login.cgi. The flaw lies in the login.cgi script where the file parameter is not sanitized, enabling an unauthenticated attacker to execute arbitrary commands on the remote host. This is described as remote c...

CVE-2005-2111

login.cgi in Community Link Pro Web Editor allows remote attackers to execute arbitrary commands via the file parameter...

PT-2005-1857 · Ciamos +2 · Ciamos +2

Name of the Vulnerable Software and Affected Versions: RUNCMS version 1.1A CIAMOS version 0.9.2 RC1 e-Xoops version 1.05 Rev3 Description: The issue allows remote attackers to read arbitrary PHP files by specifying the pathname in the file parameter. This can be used to read sensitive information...

CVE-2004-1607

slxweb.dll in SalesLogix 6.1 allows remote attackers to obtain sensitive information via a 1 Library or 2 Attachment request with an invalid file parameter, which reveals the path in an error message...