CVE-2010-2357: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in Eicra Realestate Script 1.0 and 1.6.0 allows remote attackers to execute arbitrary SQL commands via the pid parameter. NOTE: some of these details are obtained from third party information...

Pico overseas game currency leveling system 0day-vulnerability warning-the black bar safety net

漏洞 文件 :index.php code......） hhadmin/up.php an arbitrary upload vulnerability Default background address:hhadmin exp http://hack58.com/index.php?mainpage=buyitems&gid=-10 union select 1,adminname from yuadmin/qing http://hack58.com/index.php?mainpage=buyitems&gid=-10 union select 1,adminpwd from...

Unfixed XSS vulnerability at ctbp.ucsd.edu

Security researcher blackboy1337, has submitted on 21/06/2010 a cross-site-scripting XSS vulnerability affecting ctbp.ucsd.edu, which at the time of submission ranked 5649 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 31/10/2010. It is...

CVE-2010-2344: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in odCMS 1.06, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the Page parameter to 1 main/index.php, 2 members/index.php, 3 forum/index.php, 4 docs/index.php, and 5 announcements/index.php...

SnowCade 3.0 - SQL Injection

/ - SnowCade v3 SQL Injection Vulnerability - ---Date : 2010-06-19 ---Author : ahwak2000 ---Email : z.u5athotmail.com - Script Info - ---Home : http://www.arcadecreate.com/ - Vulnerability - http://site.com/path/index.php?action=browse&cat=SQL INj...

CVE-2010-2336

index.php in Yamamah Photo Gallery 1.00 allows remote attackers to obtain the source code of executable files within the web document root via the download parameter...

CVE-2010-2335

CVE-2010-2335 describes a SQL injection in Yamamah Photo Gallery 1.00 (pre-20100618) via the news parameter in index.php, allowing remote attackers to execute arbitrary SQL commands. The description confirms the vulnerable component (index.php, news parameter) and the affected version range, with...

CVE-2010-2336: Exposure of Sensitive Information to an Unauthorized Actor

index.php in Yamamah Photo Gallery 1.00 allows remote attackers to obtain the source code of executable files within the web document root via the download parameter...

ShopEx index.php脚本目录遍历漏洞

ShopEx是在国内非常流行的网上商店平台软件。 ShopEx的index.php脚本没有正确地过滤用户所提交的请求，远程攻击者可以通过在请求参数中包含目录遍历序列读取指定位置的文件。 ShopEx 4.8.5 ShopEx 4.8.4 厂商补丁： 上海商派网络科技有限公司 ------------------------ 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.shopex.cn/index.html...

CVE-2010-2335: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in Yamamah Photo Gallery 1.00, as distributed before 20100618, allows remote attackers to execute arbitrary SQL commands via the news parameter...

Directory traversal

Directory traversal vulnerability in index.php in Anodyne Productions SIMM Management System SMS 2.6.10, when magicquotesgpc is disabled, allows remote attackers to read arbitrary files via a .. dot dot in the page parameter to index.php. NOTE: some of these details are obtained from third party...

CVE-2010-2319

CVE-2010-2319 affects IDevSpot TextAds 2.08. The vulnerability is a SQL injection in index.php where the attack vector is the page parameter , enabling remote attackers to execute arbitrary SQL commands. The sources consistently describe this as a SQLi vulnerability without detailing exploit step...

CVE-2010-2319: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in IDevSpot TextAds 2.08 allows remote attackers to execute arbitrary SQL commands via the page parameter...

CVE-2010-2313: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in Anodyne Productions SIMM Management System SMS 2.6.10, when magicquotesgpc is disabled, allows remote attackers to read arbitrary files via a .. dot dot in the page parameter to index.php. NOTE: some of these details are obtained from third party...

Sql injection

SQL injection vulnerability in index.php in HauntmAx Haunted House Directory Listing CMS allows remote attackers to execute arbitrary SQL commands via the state parameter in a listings action...

CVE-2010-2312

CVE-2010-2312 is a SQL injection vulnerability in the HauntmAx Haunted House Directory Listing CMS. The issue is in index.php and allows remote attackers to execute arbitrary SQL commands via the state parameter in a listings action. The available sources confirm the vulnerability description but...

CVE-2010-2312: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in HauntmAx Haunted House Directory Listing CMS allows remote attackers to execute arbitrary SQL commands via the state parameter in a listings action...

CVE-2010-2281

TomatoCMS 2.0.6 is affected by multiple XSS in index.php. Exploitable through (1) keyword or (2) bannerid with /admin/ad/banner/list, and through (3) title or (4) answers with /admin/poll/add, or (5) name with /admin/category/add. Root cause: unsanitized input in these parameters leading to scrip...

CVE-2010-2281: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in index.php in TomatoCMS 2.0.6 allow remote attackers to inject arbitrary web script or HTML via the 1 keyword or 2 bannerid parameter in conjunction with a /admin/ad/banner/list PATHINFO; and allow remote authenticated users, with certain...

CVE-2010-1515: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in index.php in TomatoCMS 2.0.6 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 keyword or 2 article-id parameter in conjunction with a /admin/news/article/list PATHINFO; the 3 keyword parameter in conjunction...