CVE-2006-6934

Multiple cross-site scripting XSS vulnerabilities in Portix-PHP 0.4.2 allow remote attackers to inject arbitrary web script or HTML via the 1 titre or 2 auteur field in a forum post...

CVE-2006-6934

CVE-2006-6934 concerns Portix-PHP 0.4.2. The vulnerability is an XSS flaw in the forum post input: the fields Titre and Auteur can be crafted to inject arbitrary web script or HTML. The connected PT-2007-1214 document confirms the affected version and states the issue arises from user-supplied in...

CVE-2006-6934

Multiple cross-site scripting XSS vulnerabilities in Portix-PHP 0.4.2 allow remote attackers to inject arbitrary web script or HTML via the 1 titre or 2 auteur field in a forum post...

CVE-2006-6934: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Portix-PHP 0.4.2 allow remote attackers to inject arbitrary web script or HTML via the 1 titre or 2 auteur field in a forum post...

PT-2007-1214 · Portix · Portix-Php

Name of the Vulnerable Software and Affected Versions: Portix-PHP version 0.4.2 Description: The issue allows remote attackers to inject arbitrary web script or HTML via the titre or auteur field in a forum post, potentially leading to cross-site scripting XSS attacks. Recommendations: For...

bmforum漏洞exp

No description provided by source. ?php printr" +------------------------------------------------------------------+ Exploit For Blue Magic Forum All Version Fuck Register Global && Magic Quote BY 拖鞋王子 Mokfly 媒婆X Just For Fun : +------------------------------------------------------------------+...

oohasp-mdb.txt

Discovered by:Aria-Security Team Type:Remote Password Disclosure Vendor:http://sourceforge.net/project/showf...groupid=42824 PoC: http://victim.com/path/db/OhhASP.mdb Contact: [email protected] http://64.38.62.221/ariasecucom/forum/showthread.php?t=89...

ios-mdb.txt

Discovered by:Aria-Security Team Type:Remote Password Disclosure Vendor:http://diggersolutions.com/blogs/diggersolutions/default.aspx PoC: http://victim.com/path/data/intranet.mdb Contact: [email protected] http://aria-security.com/forum/showthread.php?goto=newpost&t=88...

CVE-2006-6891

CVE-2006-6891 concerns Vz (Adp) Forum 2.0.3, where sensitive admin credentials are exposed due to insufficient access control: a direct request to users/admin.txt can reveal the administrative account name and password hash. The linked sources confirm this information exposure and a partial confi...

CVE-2006-6891

Vz Adp Forum 2.0.3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the administrative account name and password hash via a direct request for users/admin.txt...

CVE-2006-6891: Undefined Security Weakness

Vz Adp Forum 2.0.3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the administrative account name and password hash via a direct request for users/admin.txt...

carbon-db.txt

Discovered by:Aria-Security Team Type:Remote Password Disclosure Vendor:http://www.carboncommunities.com/ PoC: http://target/DataBase/Carbon2.4d.mdb Contact: [email protected] http://aria-security.com/forum/showthread.php?p=113...

jgbbs

ARIA-SECURITY TEAM Forum: http://aria-security.com DiscoveredBy:t3rr0r1st from Aria-Security Type:Remote Password Disclosure Vendor:http://sourceforge.net/projects/jgbbs/ PoC: http://target/path/db/bbs.mdb Contact: [email protected] http://aria-security.com/forum/showthread.php?t=87...

CVE-2006-6828

Multiple SQL injection vulnerabilities in Efkan Forum 1.0 and earlier allow remote attackers to execute arbitrary SQL commands via 1 the grup parameter in admin.asp, or the id parameter in 2 default.asp or 3 admin.asp. NOTE: The provenance of this information is unknown; the details are obtained...

CVE-2006-6828

CVE-2006-6828 describes multiple SQL injection vulnerabilities in Efkan Forum 1.0 and earlier. The affected components are (1) default.asp (grup parameter) and (2) admin.asp (id parameter) or (3) admin.asp, allowing remote attackers to execute arbitrary SQL commands. The default.asp/grup vector i...

CVE-2006-6829

Efkan Forum 1.0 and earlier store sensitive information under the web root with insufficient access control, allowing remote attackers to download the database (forum.mdb) via a direct request. The CVSS data indicates a HIGH base score (7.8), network attack vector, no authentication, and complete...

CVE-2006-6829: Undefined Security Weakness

Efkan Forum 1.0 and earlier store sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for forum.mdb. NOTE: The provenance of this information is unknown; the details are obtained solely from third par...

vBulletin Forum SWF cross-site vulnerability-vulnerability warning-the black bar safety net

Affected system: VBulletin VBulletin = 3.6.4 Description: BUGTRAQ ID: 2 1 7 3 6 vBulletin is an open source PHP Forum program. vBulletin in processing a malicious SWF file when a vulnerability exists, a remote attacker could exploit this vulnerability to obtain the user's machine and sensitive...

CVE-2006-6828: Undefined Security Weakness

Multiple SQL injection vulnerabilities in Efkan Forum 1.0 and earlier allow remote attackers to execute arbitrary SQL commands via 1 the grup parameter in admin.asp, or the id parameter in 2 default.asp or 3 admin.asp. NOTE: The provenance of this information is unknown; the details are obtained...

Discuz论坛爆物理路径

当把变量当成数组提交时，如果不存在该数组，但存在变量，后面的pregmatch正则表达式匹配不了， 这样就出现了绝对路径的泄露 Discuz!5.2 Discuz!5.1 Discuz!4.1 Discuz!4.0 http://www.discuz.net/ 打开论坛 include 目录下的 common.inc.php $extra = isset$extra && pregmatch 改成 $extra = isset$extra && @pregmatch 1.common.inc.php问题代码207行 ..... $navtitle = $navigation = '';...