PT-2011-2624

Name of the Vulnerable Software and Affected Versions PivotX version 2.2.2 Description The issue allows remote attackers to obtain sensitive information via a non-existent file in the image parameter. This is achieved by exploiting the pivotx/modules/module image.php file, which reveals the...

PT-2010-5601

Name of the Vulnerable Software and Affected Versions FeedList plugin version 2.61.01 Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the i parameter in the feedlist/handler image.php file. Recommendations For FeedList plugin version...

PaysiteReviewCMS - 'image.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/43213/info Mechanical Bunny Media PaysiteReviewCMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser o...

PaysiteReviewCMS - image.php Cross-Site Scripting

PaysiteReviewCMS - image.php Cross-Site Scripting source: https://www.securityfocus.com/bid/43213/info Mechanical Bunny Media PaysiteReviewCMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues...

snipe Gallery Script - SQL Injection

Exploit Title: snipe gallery Script Sql Injection Date: 26/06/2010 Author: dev!l ghost Email: awsatlivedotit Site : www.h00forall.com Script url: http://sourceforge.net/projects/snipegallery/ Version: 3.1.5 Tested on: Windows CVE : ::::::::::::::::::::::::: =================Exploit===============...

Fa-Ads Bypass / Shell Upload

======================================================================================== | Title : Fa-Ads Auth Bypass Vulnerability | Author : indoushka | email : [email protected] | Home : www.iqs3cur1ty.com | Web Site : http://dl.p30vel.ir/scripts/FaAds.NulL.bY.Eh3an.FaScript.Product.zip |...

CVE-2009-3535: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in image.php in Clear Content 1.1 allows remote attackers to read arbitrary files via a .. dot dot in the url parameter. NOTE: the researcher also suggests an analogous PHP remote file inclusion vulnerability, but this may be incorrect...

e107 my_gallery 2.4.1 File Disclosure

MainHack BrotherHood http://news.serverisdown.org Vrs-hCk OoNBoY Paman bL4Ck3n91n3 Angela Zhang H312Y yooogy mousekill ^-^ loqsa zxvf martfella skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke FUCK TERORIS!! / $vuln = '/e107plugins/mygallery/image.php?file='; $trasv =...

ClearContent (image.php url) RFI/LFI Vulnerability

Exploit for unknown platform in category web applications ================================================== ClearContent image.php url RFI/LFI Vulnerability ==================================================...

Sql injection

SQL injection vulnerability in image.php in Softbiz Banner Ad Management Script allows remote attackers to execute arbitrary SQL commands via the sizeid parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2009-2232: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in image.php in Softbiz Banner Ad Management Script allows remote attackers to execute arbitrary SQL commands via the sizeid parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in myColex 1.4.2 allow remote attackers to inject arbitrary web script or HTML via 1 the year parameter to modules/kalender.php, 2 the Page parameter in a List action to modules/ereignis.php, 3 the Kontext parameter in a Search action to...

CVE-2009-1811

Multiple cross-site scripting XSS vulnerabilities in myGesuad 0.9.14 aka 0.9 allow remote attackers to inject arbitrary web script or HTML via 1 the Page parameter in a List action to modules/ereignis.php, 2 the Kontext parameter in a Search action to modules/kategorie.php, 3 the image parameter ...

CVE-2009-1809: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in myColex 1.4.2 allow remote attackers to inject arbitrary web script or HTML via 1 the year parameter to modules/kalender.php, 2 the Page parameter in a List action to modules/ereignis.php, 3 the Kontext parameter in a Search action to...

CVE-2009-1811: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in myGesuad 0.9.14 aka 0.9 allow remote attackers to inject arbitrary web script or HTML via 1 the Page parameter in a List action to modules/ereignis.php, 2 the Kontext parameter in a Search action to modules/kategorie.php, 3 the image parameter ...

CVE-2009-1447: Undefined Security Weakness

Unrestricted file upload vulnerability in admin/editor/image.php in e-cart.biz Free Shopping Cart allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in images/...

e-cart.biz Shopping Cart Shell Upload

=-=-Remote Arbitrary File Upload-=-= -=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-= script::e-cart Shopping Carts ------------------------------------------------- Author: ahmadbady =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= download from:http://www.e-cart.biz/e-cartFree.zip...

e-cart.biz Shopping Cart - Arbitrary File Upload

e-cart.biz Shopping Cart - Arbitrary File Upload =-=-Remote Arbitrary File Upload-=-= -=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-= script::e-cart Shopping Carts ------------------------------------------------- Author: ahmadbady =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= download...

Directory traversal

Directory traversal vulnerability in framework/Image/Image.php in Horde before 3.2.4 and 3.3.3 and Horde Groupware before 1.1.5 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the HordeImage driver name...

CVE-2009-0932

Directory traversal vulnerability in framework/Image/Image.php in Horde before 3.2.4 and 3.3.3 and Horde Groupware before 1.1.5 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the HordeImage driver name...