CVE-2006-6278

CVE-2006-6278 is a cross-site scripting (XSS) vulnerability in the index.php of @lex Guestbook 4.0.1 , exploitable via the skin parameter to inject arbitrary web script or HTML. Affected software: @lex Guestbook 4.0.1 (index.php). The documents confirm the vulnerability and payload type but do no...

CVE-2006-6248

index.php in GPhotos 1.5 allows remote attackers to obtain sensitive information via an invalid rep parameter, which reveals the full path in an error message...

CVE-2006-6279

Vulnerability CVE-2006-6279 affects @lex Guestbook 4.0.1. The issue occurs in index.php where a skin parameter referencing a nonexistent skin causes an error message that reveals the installation path, enabling information disclosure to remote attackers. The NVD entry lists this as a medium-sever...

CVE-2006-6279

index.php in @lex Guestbook 4.0.1 allows remote attackers to obtain sensitive information via a skin parameter referencing a nonexistent skin, which reveals the installation path in an error message...

CVE-2006-6278

Cross-site scripting XSS vulnerability in index.php in @lex Guestbook 4.0.1 allows remote attackers to inject arbitrary web script or HTML via the skin parameter...

CVE-2006-6285

CVE-2006-6285 affects Kai Blankenhorn Bitfolge (snif) up to version 1.5.2. The issue is a PHP remote file inclusion vulnerability in index.php via the externalConfig parameter, enabling arbitrary PHP code execution. Note: CVE entries and third parties dispute the vulnerability because externalCon...

CVE-2006-6248

GPhotos 1.5 contains a vulnerability in index.php where the invalid rep parameter can trigger an error message that reveals the full filesystem path. This CVE (CVE-2006-6248) is documented with a remote information disclosure impact (confidentiality) and a network attack vector, but no concrete r...

CVE-2006-6232

CVE-2006-6232 describes a PHP remote file inclusion vulnerability in DreamAccount 3.1, affecting admin/index.php via a URL in the path parameter. The underlying issue is a RFI in the path handling, allowing an attacker to execute arbitrary PHP code on the server. Documented impact is partial conf...

CVE-2006-6218

Multiple SQL injection vulnerabilities in index.php in dev4u CMS allow remote attackers to execute arbitrary SQL commands via the 1 seiteid, 2 gruppeid.php, and 3 gotarget parameters...

CVE-2006-6218

CVE-2006-6218 relates to dev4u CMS, where index.php is vulnerable to SQL injection via the (1) seite_id, (2) gruppe_id.php, and (3) go_target parameters. The root cause is improper handling/sanitization of input used in SQL queries, allowing remote attackers to alter the intended query and execut...

CVE-2006-6219

dev4u CMS is affected by multiple cross-site scripting (XSS) flaws in index.php, exploitable via the parameters (1) user_name, (2) passwort, and (3) go_target. The issue allows remote attackers to inject arbitrary web script or HTML. CVSSv2 base score is 6.8 (MEDIUM), with NETWORK attack vector, ...

Invision Gallery 2.0.7 SQL Injection Vulnerability

Invision Gallery 2.0.7 DOS attak can be performed index.php?automodule=gallery&cmd=postcomment&op=doaddcomment&Post=test&img=111 OR id IN SELECT BENCHMARK10000000,BENCHMARK10000000,md5currentdate FROM ipbgalleryimages...

snif <= 1.5.2 (index.php) Remote File Inclusion Vulnerability

No description provided by source. snif simple and nice index file Remote File Include Vulnerability Download Site: http://www.bitfolge.de/download/snif152.zip Found & Exploiting By: S.W.A.T. advistory: wWw.Xmors.CoM - wWw.XmorS.NeT POC:...

Wordpress Index.PHP跨站脚本漏洞

Wordpress是一款基于php的WEB应用程序。 Wordpress不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行跨站脚本获得敏感信息。 问题是由于'Index.PHP'脚本对用户提交的's'参数缺少过滤，提交恶意脚本代码作为参数数据，并诱使用户打开，可导致恶意脚本在目标浏览器上执行，可获得敏感信息。 WordPress WordPress 1.5 升级到Wordpress 2.0.6版本： http://wordpress.org/ http://www.example.com/wp-admin/edit.php?s=XSS&submit=Search...

CVE-2006-6157

ContentNow is affected by an SQL injection in index.php (v1.39 and earlier) that allows remote attackers to inject arbitrary SQL via the pageid parameter. The underlying issue can also expose path information when a non-existent/invalid pageid is provided. Affected product: ContentNow up to versi...

Sisfo Kampus 0.8 - Remote File Inclusion / Download

Source Code = Sisfokampus 0.8 Website = www.Sisfokampus.net Author = E. Setio Dewo [email protected] Dorkz : Allinurl: /index.php?exec= File Vuln : index.php print.php download.php Local File Include Found by : Wawan Firmansyah a.k.a Ang|n [email protected] Source of index.php...

CVE-2006-6069

index.php in mAlbum 0.3 and earlier allows remote attackers to obtain the installation path via an invalid gal parameter...

CVE-2006-6069

CVE-2006-6069 affects mAlbum 0.3 and earlier; index.php is vulnerable to an invalid gal parameter, enabling remote attackers to obtain the installation path. The CVSS2 base score is 5.0 (NETWORK vector, low attack complexity, no authentication, partial confidentiality impact). No remediation deta...

CVE-2006-6069

index.php in mAlbum 0.3 and earlier allows remote attackers to obtain the installation path via an invalid gal parameter...

CVE-2006-6037

Multiple cross-site scripting XSS vulnerabilities in index.php in Dan Jensen Travelsized CMS 0.4.1 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 page, 2 pageid, or 3 language parameter...