Cross site scripting

Cross-site scripting XSS vulnerability in index.php in ModX 0.9.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter. NOTE: this might be resultant from the directory traversal vulnerability...

Cross site scripting

Cross-site scripting XSS vulnerability in index.php in phpLinks 2.1.3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the term parameter...

Directory traversal

Directory traversal vulnerability in index.php in phpWebFTP 3.2 and earlier allows remote attackers to read arbitrary files via a .. dot dot in the language parameter...

CVE-2006-1807

Multiple SQL injection vulnerabilities in index.php in Musicbox 2.3.3 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 start parameter in a search action or 2 type parameter in a top action...

CVE-2006-1809

index.php in Lifetype 1.0.3 allows remote attackers to obtain sensitive information via an invalid show parameter, which reveals the path in an error message...

CVE-2006-1806

CVE-2006-1806 describes a cross-site scripting (XSS) vulnerability in Musicbox 2.3.3 and earlier. The issue is triggered via the term parameter in a search action within index.php, allowing remote attackers to inject arbitrary web script or HTML. The NVD entry for this CVE confirms the vulnerable...

CVE-2006-1825

Cross-site scripting XSS vulnerability in index.php in phpLinks 2.1.3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the term parameter...

CVE-2006-1807

Multiple SQL injection vulnerabilities in index.php in Musicbox 2.3.3 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 start parameter in a search action or 2 type parameter in a top action...

CVE-2006-1809

index.php in Lifetype 1.0.3 allows remote attackers to obtain sensitive information via an invalid show parameter, which reveals the path in an error message...

CVE-2006-1807

CVE-2006-1807 affects MusicBox (older releases) where the PHP file index.php is vulnerable to SQL injection. The vulnerability allows remote attackers to inject arbitrary SQL via the (1) start parameter in a search action or (2) type parameter in a top action, in MusicBox 2.3.3 and earlier. Conne...

CVE-2006-1808

The CVE-2006-1808 entry describes a Cross-site Scripting (XSS) vulnerability in Lifetype 1.0.3, exploitable via the show parameter in a Template operation of index.php. The vulnerability allows remote attackers to inject arbitrary web script or HTML. Affected product: Lifetype 1.0.3. Root cause/s...

CVE-2006-1802

The CVE-2006-1802 issue affects TinyWebGallery 1.3 and 1.4, with a Cross-Site Scripting (XSS) flaw in index.php via the twg_album parameter. Remote attackers could inject arbitrary script/HTML. Root cause: unsanitized input in the twg_album parameter. No explicit remediation details are provided ...

phpwebftp -- "language" Local File Inclusion

Secunia reports: phpWebFTP have a vulnerability, which can be exploited by malicious people to disclose sensitive information. Input passed to the "language" parameter in index.php isn't properly verified, before it is used to include files. This can be exploited to include arbitrary files from...

AnimeGenesis <= XSS

==================== Discovered by: Qex Date: 17 April 2006 ==================== index.php?cat=XSS...

phpLinks <= 2.1.3.1 XSS vuln.

phpLinks = 2.1.3.1 XSS vuln. Vuln. discovered by : r0t Date: 16 april 2006 vendorlink:http://sourceforge.net/projects/phplinks/ affected versions:phpLinks 2.1.3.1 and previous orginal advisory: http://pridels.blogspot.com/2006/04/phplinks-2131-xss-vuln.html Vuln. Description: phpLinks contains a...

phpWebFTP index.php language Parameter Local File Inclusion

The remote host is running phpWebFTP, a web-based FTP client written in PHP. The version of phpWebFTP installed on the remote host fails to sanitize user-supplied input to the 'language' parameter of the 'index.php' script before using it in a PHP 'include' function. An unauthenticated attacker m...

Coppermine Photo Gallery index.php file Parameter Local File Inclusion

The version of Coppermine Gallery installed on the remote host fails to properly sanitize input to the 'file' parameter of the 'index.php' script before using it in a PHP 'includeonce' function. Regardless of PHP's 'registerglobals' setting, an unauthenticated attacker may be able to exploit this...

phpList index.php database_module Parameter Local File Inclusion

The version of phpList installed on the remote host fails to sanitize user-supplied input to the 'databasemodule' parameter of the 'lists/index.php' script before using it in a PHP 'requireonce' function. Provided PHP's 'registerglobals' setting is enabled, an unauthenticated attacker may be able...

phpWebSite <= 0.10.2 (hub_dir) Remote Commands Execution Exploit

No description provided by source. !/usr/bin/php -q -d shortopentag=on ? echo "PHPWebSite = 0.10.2 remote cmmnds xctn\r\n"; echo "- arbitrary local inclusion, works with magicquotesgpc = Off\r\n"; echo "by rgod, mail: [email protected]\r\n"; echo "site: http://retrogod.altervista.org\r\n\r\n"; i...

Sql injection

Multiple SQL injection vulnerabilities in Papoo 2.1.5, and 3 beta1 and earlier, allow remote attackers to execute arbitrary SQL commands via the 1 getlang and 2 reporeid parameter in a index.php, 3 menuid parameter in b plugin.php and c forumthread.php, and 4 msgid parameter in forumthread.php...