CVE-2006-1562

The CVE-2006-1562 entry concerns vulnerable [V]Book (aka VScripts/VBook) version 2.0 by Kuba Kunkiewicz. Multiple cross-site scripting (XSS) vulnerabilities exist in index.php, exploitable via four parameters (autor, www, temat, tresc). The underlying issue is insufficient input sanitization, all...

MonAlbum 0.8.7 SQL Injection

advisory by undefined1 @ bash-x.net/undef/ Mon Album 0.8.7 http://www.3dsrc.com/monalbum/ There are 2 sql injection flaws in MonAlbum 0.8.7. First in index.php line 99 if isset$GET"pc" $pc = $GET"pc"; ... no sanity checks if isset$pc && $grechinactive $result = executerequete"select idrub, nom,...

CVE-2006-1501

SQL injection vulnerability in index.php in OneOrZero 1.6.3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter, possibly in the kans action...

Sql injection

SQL injection vulnerability in index.php in OneOrZero 1.6.3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter, possibly in the kans action...

CVE-2006-1496

Multiple cross-site scripting XSS vulnerabilities in index.php in ViHor Design allow remote attackers to inject arbitrary web script or HTML via 1 a remote URL in the page parameter, which is processed by an fopen call, or 2 HTML or script in the page parameter, which is returned to the client in...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in index.php in ViHor Design allow remote attackers to inject arbitrary web script or HTML via 1 a remote URL in the page parameter, which is processed by an fopen call, or 2 HTML or script in the page parameter, which is returned to the client in...

CVE-2006-1497

CVE-2006-1497 is a directory traversal vulnerability in ViHor Design’s index.php. The vulnerability arises from handling of the page parameter, enabling remote attackers to read arbitrary files on the affected system. The NVD entry lists a MEDIUM base score (CVSSv2: AV:N/AC:L/Au:N/C:P/I:N/A:N) wi...

CVE-2006-1496

CVE-2006-1496 describes multiple cross-site scripting (XSS) vulnerabilities in ViHor Design’s index.php. The vulnerability arises from the vulnerable page parameter being used in two ways: (1) as a remote URL supplied to fopen, and (2) as HTML or script content that is echoed back to the client i...

CVE-2006-1496

Multiple cross-site scripting XSS vulnerabilities in index.php in ViHor Design allow remote attackers to inject arbitrary web script or HTML via 1 a remote URL in the page parameter, which is processed by an fopen call, or 2 HTML or script in the page parameter, which is returned to the client in...

CVE-2006-1482

CVE-2006-1482 is an XSS vulnerability in ConfTool 1.1, triggered by the page parameter in index.php. An attacker can inject arbitrary web script/HTML, potentially executing in a user’s browser when the affected page is viewed. The vulnerability is documented across multiple sources (NVD entry for...

SQL-Injection and XSS in uTopsites 1.5.1

Advisory: SQL-Injection and XSS in uTopsites 1.5.1. Уязвимый скрипт: index.php Sql-injection: http://www.listrank.com/index.php?do=out&id='22 Xss: http://www.listrank.com/index.php?o=scriptalert/script&start=50 При добавлении комментариев не фильтруется ни одно поле. Пример: "scriptalert/script"...

XSS in Monster Top List 1.4

Advisory: XSS in Monster Top List 1.4 Home Page: http://www.monstertoplist.com/ Уязвимость/Vulnerability: Межсайтовый скриптинг/Cross Site Scripting Уязвимый скрипт/Vulnerable script: index.php Exploit: http://www.monstertoplist.com/mtl14/index.php?usererrormessage=scriptalert/script...

XSS in In-link 2.2.6

Advisory: XSS in In-link 2.2.6 Уязвимость/Vulnerability: Межсайтовый скриптинг/Cross Site Scripting Уязвимый скрипт/Vulnerable script: index.php Exploit: http://mailinfo.ru/catalog/index.php?sid=27795275575&t=login&attach=27t=modify"scriptalert/script"...

Sql injection

Multiple SQL injection vulnerabilities in Pixel Motion Blog allow remote attackers to execute arbitrary SQL commands via the 1 date parameter in index.php or bypass authentication via the 2 password parameter in admin/index.php...

Sql injection

SQL injection vulnerability in the Calendar module in nuked-klan 1.7.5 and earlier allows remote attackers to execute arbitrary SQL commands via the m parameter to index.php...

CVE-2006-1426

Multiple SQL injection vulnerabilities in Pixel Motion Blog allow remote attackers to execute arbitrary SQL commands via the 1 date parameter in index.php or bypass authentication via the 2 password parameter in admin/index.php...

CVE-2006-1426

Multiple SQL injection vulnerabilities in Pixel Motion Blog allow remote attackers to execute arbitrary SQL commands via the 1 date parameter in index.php or bypass authentication via the 2 password parameter in admin/index.php...

Pixel Motion - index.php?date SQL Injection

Pixel Motion - index.php?date SQL Injection source: https://www.securityfocus.com/bid/17260/info Pixel Motion is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. A...

Nuked-klaN 1.x - index.php SQL Injection

Nuked-klaN 1.x - index.php SQL Injection source: https://www.securityfocus.com/bid/17233/info Nuked-Klan is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. A successful exploit cou...

DSLogin 1.0 - 'index.php' Multiple SQL Injections

source: https://www.securityfocus.com/bid/17262/info DSLogin is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to compromis...