Directory traversal

thumbsup.php in Thumbs-Up 1.12, as used in LightNEasy "no database" aka flat and SQLite 1.2.2 and earlier, allows remote attackers to copy, rename, and read arbitrary files via directory traversal sequences in the image parameter with a modified cachedir parameter containing a %00 encoded null by...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in engine/modules/imagepreview.php in Datalife Engine 6.7 allows remote attackers to hijack the authentication of arbitrary users for requests that use a modified image parameter...

CVE-2008-6466

SQL injection vulnerability in imagegallery.php in the Akira Powered Image Gallery imagegallery plugin 0.9.6.2 for e107 allows remote attackers to execute arbitrary SQL commands via the image parameter in an image-detail action...

Cross site scripting

Cross-site scripting XSS vulnerability in index.php in JV2 Folder Gallery 3.1 allows remote attackers to inject arbitrary web script or HTML via the image parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-1634

Cross-site scripting XSS vulnerability in index.php in JV2 Folder Gallery 3.1 allows remote attackers to inject arbitrary web script or HTML via the image parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-1634

Cross-site scripting XSS vulnerability in index.php in JV2 Folder Gallery 3.1 allows remote attackers to inject arbitrary web script or HTML via the image parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2007-3292

Unrestricted file upload vulnerability in LiveCMS 3.4 and earlier allows remote attackers to upload and execute arbitrary PHP code by specifying a PHP file type in a parameter intended for "a small image" associated with an article...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Dokeos 1.8.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the img parameter to main/inc/lib/fckeditor/editor/plugins/ImageManager/editor.php and other unspecified vectors...

PT-2006-6306 · Unknown · Goop Gallery

Name of the Vulnerable Software and Affected Versions: GOOP Gallery versions prior to 2.0.3 Description: A cross-site scripting issue exists, allowing remote attackers to inject arbitrary HTML or web script via the image parameter in the index.php file. Recommendations: For versions prior to 2.0....

GOOP-image.txt

GOOP Gallery 'image' param Cross-site scripting Vendor url:http://www.webgeneius.com Advisore:http://lostmon.blogspot.com/2006/10/ goop-gallery-image-param-cross-site.html Vendor notify: YES Exploit available: YES GOOP Gallery contains a flaw that allows a remote cross site scripting attack.This...

TinyWebGallery 1.5 - 'image' Remote File Inclusion

C Y B E R - W A R R i O R T I M TinyWebGallery v1.5 image Remote Include Vulnerability ------------------------------------------------------------------------------ Author: xoron ------------------------------------------------------------------------------ Script: TinyWebGallery...

CVE-2006-3020

Multiple cross-site scripting XSS vulnerabilities in FullPhoto.asp in WS-Album 1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 image and 2 PublisedDate parameters...

CVE-2006-3020

Multiple cross-site scripting XSS vulnerabilities in FullPhoto.asp in WS-Album 1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 image and 2 PublisedDate parameters...

CVE-2006-2262

Cross-site scripting XSS vulnerability in index.php in singapore 0.9.7 allows remote attackers to inject arbitrary web script or HTML via the image parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in index.php in singapore 0.9.7 allows remote attackers to inject arbitrary web script or HTML via the image parameter...

CVE-2005-1930

Directory traversal vulnerability in the Crystal Report component rptserver.asp in Trend Micro ServerProtect Management Console 5.58, as used in Control Manager 2.5 and 3.0 and Damage Cleanup Server 1.1, and possibly earlier versions, allows remote attackers to read arbitrary files via the IMAGE...

CVE-2004-2266

CVE-2004-2266 affects Ansel 2.1 and earlier. The issue is a SQL injection vulnerability that allows remote attackers to modify SQL statements via the image parameter. According to the provided data, the NVD CVSS v2.0 base score is 7.5 (HIGH) with network attack vector, low attack complexity, no a...

CVE-2004-2266

SQL injection vulnerability in Ansel 2.1 and earlier allows remote attackers to modify SQL statements via the image parameter...

CVE-2005-1896

Directory traversal vulnerability in thumb.php in FlatNuke 2.5.3 allows remote attackers to read arbitrary images or obtain the installation path via the image parameter...

CVE-2005-1403

Multiple cross-site scripting XSS vulnerabilities in JustWilliam's Amazon Webstore 04050100 allow remote attackers to inject arbitrary web script or HTML via the 1 image parameter to closeup.php, the 2 currentIsExpanded or 3 searchFor parameters to index.php, 4 the currentNumber parameter to...