7215 matches found
CVE-2005-2979
CVE-2005-2979 describes a SQL injection in Noah’s classifieds (index.php) by manipulating the rollid parameter. Public documents identify Noah’s classifieds as the affected software and point to an underlying input handling flaw in index.php, enabling remote SQL command execution. The NVD entry l...
Noahs Classifieds 1.21.3 - index.php SQL Injection
Noahs Classifieds 1.21.3 - index.php SQL Injection source: https://www.securityfocus.com/bid/14833/info Noah's Classifieds is prone to an SQL injection vulnerability. This is due to a lack of proper sanitization of user-supplied input before using it in an SQL query. Successful exploitation could...
CVE-2005-2814
Cross-site scripting XSS vulnerability in FlatNuke 2.5.6 allows remote attackers to inject arbitrary web script or HTML via the usr parameter in a visreg operation to index.php...
CVE-2005-2818
CVE-2005-2818 concerns a cross-site scripting (XSS) vulnerability in DownFile 1.3. The issue arises from unvalidated input in the id parameter passed to four PHP scripts (email.php, index.php, del.php, add_form.php), enabling remote attackers to inject arbitrary JavaScript/HTML. The available doc...
CVE-2005-2813
CVE-2005-2813 concerns FlatNuke 2.5.6 (and possibly earlier) with a directory traversal in index.php reading via the id parameter (read mod), allowing an attacker to read arbitrary files using .. and %00. The connected Nessus/NVD entries confirm the vulnerability path and document that affected s...
CVE-2005-2818
Cross-site scripting XSS vulnerability in DownFile 1.3 allows remote attackers to inject arbitrary web script or HTML via the id parameter to 1 email.php,2 index.php, 3 del.php, or 4 addform.php...
CVE-2005-2788
Multiple SQL injection vulnerabilities in Land Down Under LDU 801 and earlier allow remote attackers to execute arbitrary SQL commands via the c parameter to 1 events.php, 2 index.php, or 3 list.php...
CVE-2005-2674
Affected product: Land Down Under (LDU) 800 series (
w-Agora index.php site Parameter Traversal Arbitrary File Access
The remote host is running w-agora, a web-based forum application written in PHP. The remote version of this software is prone to directory traversal attacks. A remote attacker could request a specially crafted URL to read arbitrary files on the remote system with the privileges of the web server...
CVE-2005-2648
W-Agora is affected by CVE-2005-2648: a directory traversal in index.php via the site parameter allows remote reading of arbitrary files on affected versions (W-Agora 4.2.0 and earlier). OpenVAS/Nessus entries corroborate this vulnerability and indicate remediation by upgrading to a fixed release...
CVE-2004-2456
SQL injection vulnerability in index.php in miniBB 1.7f and earlier allows remote attackers to execute arbitrary SQL commands via the user parameter in a userinfo action...
CVE-2004-2456
CVE-2004-2456 is a SQL injection in miniBB (index.php, userinfo action) affecting miniBB 1.7f and earlier. The vulnerability arises from unsanitized input in the user parameter of index.php, enabling remote attackers to execute arbitrary SQL commands. The connected Nessus/NASL entries reference a...
CVE-2004-2444
CVE-2004-2444 describes a cross-site scripting (XSS) flaw in index.php of Jaws 0.3, exploitable via the action parameter to inject arbitrary script/HTML. The provided documents do not include explicit vendor/version patches or a confirmed exploit in the wild. No additional technical details, root...
CVE-2004-2445
CVE-2004-2445: Directory traversal in Jaws 0.3 BETA index.php via the gadget parameter allows remote attackers to view arbitrary files using dot-dot sequences. This is documented in multiple sources (NVD/CVE records and Nessus-like disclosures) and confirms a file-read vulnerability in the early ...
CVE-2003-1231
Cross-site scripting XSS vulnerability in index.php in ECW-Shop 5.5 allows remote attackers to inject arbitrary web script or HTML via the cat parameter...
CVE-2005-2622
The CVE-2005-2622 entry concerns ECW-Shop 6.0.2. The affected component is index.php, with a vulnerability in the parameters (1) max and (2) ctg that allows cross-site scripting (XSS). The NVD entry lists a CVSSv2 base score of 4.3 (Medium) with network attack vector, requiring no authentication,...
CVE-2003-1231
CVE-2003-1231: Cross-site scripting (XSS) in ECW-Shop 5.5 (index.php) allows remote attackers to inject arbitrary script/HTML via the cat parameter. The provided sources describe the vulnerability but do not include explicit exploit code, affected versions beyond 5.5, or remediation steps. No add...
CVE-2005-2622
Cross-site scripting XSS vulnerability in index.php in ECW-Shop 6.0.2 allows remote attackers to inject arbitrary web script or HTML via the 1 max or 2 ctg parameter...
CVE-2005-2610
The CVE-2005-2610 entry describes a Cross‑Site Scripting (XSS) vulnerability in VegaDNS where index.php accepts a message parameter. Affected versions include VegaDNS 0.8.1 and 0.9.8 (and possibly other versions). The underlying issue allows remote attackers to inject arbitrary web script or HTML...