CVE-2003-1406: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in D-Forum 1.00 through 1.11 allows remote attackers to execute arbitrary PHP code via a URL in the 1 myheader parameter to header.php3 or 2 myfooter parameter to footer.php3...

CVE-2007-5575

Cross-site request forgery CSRF vulnerability in 1024 CMS 1.2.5 allows remote attackers to perform some actions as administrators, as demonstrated by 1 an unspecified action that creates a file containing PHP code and 2 unspecified use of the forum component. NOTE: the provenance of this...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in 1024 CMS 1.2.5 allows remote attackers to perform some actions as administrators, as demonstrated by 1 an unspecified action that creates a file containing PHP code and 2 unspecified use of the forum component. NOTE: the provenance of this...

CVE-2007-5575

The CVE-2007-5575 entry concerns CSRF in 1024 CMS 1.2.5 that lets remote attackers perform administrator actions. The available details illustrate two examples: an action that creates a file containing PHP code and an action involving the forum component. The documents do not provide concrete exp...

CVE-2007-5575: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in 1024 CMS 1.2.5 allows remote attackers to perform some actions as administrators, as demonstrated by 1 an unspecified action that creates a file containing PHP code and 2 unspecified use of the forum component. NOTE: the provenance of this...

awzMB 4.2 Beta 1 - Multiple Remote File Inclusions

awzMB 4.2 Beta 1 - Multiple Remote File Inclusions \|/// \ - - // Xmors Underground Group @ @ ----oOOo---oOOo-------------------------------------------------- Portal : awzMB system Version 4.2 beta 1 Guestbook/Weblog/Contact Download : http://downloads.sourceforge.net/awzmb/awzmb4.2beta1.zip...

CVE-2003-1370: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Nuked-Klan 1.2b allow remote attackers to inject arbitrary HTML or web script via 1 the Author field in the Guestbook module, 2 the Titre or Pseudo fields in the Forum module, or 3 "La Tribune Libre" in the Shoutbox module...

Fragile shangdu v1. 0 1 Press system-vulnerability warning-the black bar safety net

Last weekend at the forum saw a friend made a penetration shangdu official station of the post, the points go see a bit of the original is one of the official demo station of penetration. Penetration of the condition is the default password into the background, and then use the program whole and ...

Dvbbs8 Action Network Forum latest 0day research-vulnerability warning-the black bar safety net

I here it has been assumed that a DVBBS8 SQL: We first register a user, just find a post. Just broke。。。。 We have to re-send a post. Discovery table review, where to capture | POST /dvbbs8/Appraise. asp? action=save HTTP/1.1 Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,...

Simple Forum (for WordPress) sql-inject exploit (public version)

Добрый день. Я нашел уязвимость в форме Simple Forum для движка WordPress. Решил первыми осведомить вас! : Через пару минут буду отсылать на milw0rm...

TikiWiki php injection

оф сайт http://tikiwiki.org/ уязвимость носит критический характер. файл tiki-graphformula.php содержит код: foreach arrayvalues $GET'f' as $key=$formula $formula = convertformula $formula ; ... function convertformula $formula ... return createfunction'$x', "return $formula;"; Poc:...

Phpwind Forum of a back door way-vulnerability warning-the black bar safety net

the pw of a back door way data\bbscache\adminrecord. php is recording the background to the landing and operation,we see how the operation of this file: admin\admincp.php: $bbsrecordfile=DP."data/bbscache/adminrecord.php"; if! fileexists$bbsrecordfile writeover$bbsrecordfile,"? php die;?& gt;\n";...

CVE-2004-2725

Multiple cross-site scripting XSS vulnerabilities in Aztek Forum 4.0 allow remote attackers to inject arbitrary web script or HTML via 1 the search parameter in a search.php, 2 the email parameter in b subscribe.php, and 3 the return and 4 title parameters in c forum2.php...

CVE-2004-2725

CVE-2004-2725 affects Aztek Forum 4.0, with XSS vulnerabilities in multiple entry points: search.php (search parameter), subscribe.php (email parameter), and forum_2.php (return and title parameters). The underlying issue is improper handling/sanitization of user-supplied input, allowing remote a...

CVE-2004-2725: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Aztek Forum 4.0 allow remote attackers to inject arbitrary web script or HTML via 1 the search parameter in a search.php, 2 the email parameter in b subscribe.php, and 3 the return and 4 title parameters in c forum2.php...

Format string in The Dawn of Time 1.69s beta4

Luigi Auriemma Application: The Dawn of Time http://www.dawnoftime.org Versions: = 1.69s beta4 and 1.69r too Platforms: nix and Windows Bug: format string in web server authorization Exploitation: remote Date: 05 Oct 2007 Author: Luigi Auriemma e-mail: [email protected] web: aluigi.org 1...

Picturesolution 2.1 - config.php?path Remote File Inclusion

Picturesolution 2.1 - config.php?path Remote File Inclusion Picturesolution = v2.1 config.php path Remote File Inclusion Vulnerabilities Found By : Mogatil , http://www.hackteach.org/cc/ Posted By : Cold z3ro , http://www.hackteach.org/cc/ Exploit :...

Remote file inclusion

PHP remote file inclusion vulnerability in htmls/forum/includes/topicreview.php in UniversiBO 1.3.4 allows remote attackers to execute arbitrary PHP code via a URL in the phpbbrootpath parameter. NOTE: this issue is disputed by CVE because the applicable include is in a function that is not calle...

Remote file inclusion

PHP remote file inclusion vulnerability in forum/forum.php in lustig.cms BETA 2.5 allows remote attackers to execute arbitrary PHP code via a URL in the view parameter...

CVE-2007-5138

CVE-2007-5138 is a PHP remote file inclusion vulnerability affecting lustig.cms BETA 2.5, reported as a flaw in forum/forum.php where an attacker could trigger arbitrary PHP code execution by supplying a URL in the view parameter. The vulnerability is documented across multiple sources (NVD and C...