CVE-2006-3246

CVE-2006-3246 describes a stored/reflected XSS in GL-SH Deaf Forum 6.4.3 and earlier, exploitable via the sort parameter in show.php. Impact: attacker can inject arbitrary script/HTML. Root cause: insufficient input sanitization for the sort parameter. Public remediation details are not provided ...

abrior.txt

Azhteam Digital Security Team Abrior's Encore WebForum display.cgi Find by : soltandefacer www.azhteam.com Greetings; s.defacer - azhteam - lvl3hr - edi.programe Bugs File : /forumcgi/display.cgi? Display : http://www.target.com/encore/forumcgi/display.cgi? 1. search in Google --...

blacksingles.txt

Blacksingles.com Homepage: http://www.blacksingles.com Affected files Profile input boxes Add a friend input box. list.html view.html reply.html compose.html ------------------------------------------------- XSS vuln with cookie disclosure via the Location box. User data isn't sanatized before...

CVE-2006-3168

SQL injection vulnerability in CS-Forum before 0.82 allows remote attackers to execute arbitrary SQL commands via the 1 id and 2 debut parameters in a read.php, and the 3 search and 4 debut parameters in b index.php...

CVE-2006-3169

Multiple cross-site scripting XSS vulnerabilities in CS-Forum 0.81 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 msgresult and 2 reptitre parameters in a read.php; and the 3 id and 4 parent parameters and 5 CSForumnom, 6 CSForummail, and 7 CSForumurl cookie...

CVE-2006-3170

CS-Forum before 0.82 allows remote attackers to obtain sensitive information via unspecified manipulations, possibly involving an empty collapse or readall parameter to index.php, which reveals the installation path in an error message...

CVE-2006-3171

CRLF injection vulnerability in CS-Forum before 0.82 allows remote attackers to inject arbitrary email headers via a newline character in the email parameter to ajouter.php...

CVE-2006-3173

Multiple PHP remote file inclusion vulnerabilities in ContentBuilder 0.7.5 allow remote attackers to execute arbitrary PHP code via a URL in the 1 pathcb parameter to a libraries/comment/postComment.php and b modules/poll/poll.php, 2 rel parameter to c modules/archive/overview.inc.php, and the 3...

CVE-2006-3169

Multiple cross-site scripting XSS vulnerabilities in CS-Forum 0.81 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 msgresult and 2 reptitre parameters in a read.php; and the 3 id and 4 parent parameters and 5 CSForumnom, 6 CSForummail, and 7 CSForumurl cookie...

CVE-2006-3170

CS-Forum prior to 0.82 is vulnerable to a remote path-disclosure via index.php, caused by unspecified manipulations (collapse[] or readall) that reveal the installation path in an error message. The affected product is CS-Forum; the indicator specifies version

CVE-2006-3168

SQL injection vulnerability in CS-Forum before 0.82 allows remote attackers to execute arbitrary SQL commands via the 1 id and 2 debut parameters in a read.php, and the 3 search and 4 debut parameters in b index.php...

CVE-2006-3169

CVE-2006-3169 affects CS-Forum 0.81 and earlier. The vulnerabilities exist in the web application’s read.php (parameters msg_result, rep_titre) and ajouter.php (parameters id, parent, CSForum_nom, CSForum_mail, CSForum_url; cookie parameters) allowing cross-site scripting. Root cause: improper ha...

CVE-2006-3171

CRLF injection vulnerability in CS-Forum before 0.82 allows remote attackers to inject arbitrary email headers via a newline character in the email parameter to ajouter.php...

CVE-2006-3171

CS-Forum prior to 0.82 is affected by a CRLF injection vulnerability that lets remote attackers inject arbitrary email headers via a newline character in the email parameter of ajouter.php. Root cause is improper handling of newline characters in user-supplied input, leading to header injection. ...

CVE-2006-3168

CVE-2006-3168 is a SQL injection vulnerability in CS-Forum before version 0.82. The vulnerability allows remote attackers to execute arbitrary SQL commands through input parameters: (1) id and (2) debut in read.php, and (3) search and (4) debut in index.php. The exact root cause is an inadequate ...

CVE-2006-3170

CS-Forum before 0.82 allows remote attackers to obtain sensitive information via unspecified manipulations, possibly involving an empty collapse or readall parameter to index.php, which reveals the installation path in an error message...

Dragons Kingdom v1.0 - XSS & cookie disclosure

Dragons Kingdom Script v1.0 Homepage: http://www.dkscript.com/ Affected files: Sending mail: - Sending in-game mail Character Profiles: - All input boxes of the profile Posting & Replying in the forum: - Posting in the forum - Replying in the forum Form spoofing can occur in: - Profile input boxe...

about.txt

About.com Homepage: http://www.about.com Effected files: Search input box fullsearch.htm shortform.htm forum.aspx profilecenter.asp posting in the forum ----------------------------------- Search input box xss vuln with cookie disclosure: Works by putting the tags in the input box, or doing url...

CVE-2006-3096

CVE-2006-3096: Multiple SQL injection vulnerabilities in iPostMX 2005 2.0 and earlier allow remote attackers to execute arbitrary SQL via user-controlled input in (1) the forum parameter in messagepost.cfm and (2) the topic parameter in topics.cfm. Root cause described as improper handling of inp...

multiple Xss exploits in 35mmslidegallery V6

multiple Xss exploits in 35mmslidegallery V6 forum type : 35mmslidegallery V6 bug found by : black-code team : $!T3-D0WN type : Xss exploits : http://example.com/lumet/album/index.php?imgdir='scriptalert10/script http://example.comr/lumet/album/popup.php?w='scriptalert10/script...