13714 matches found
DDL CMS 1.0 Remote File Inclusion
+============================================================+ | | | DDL CMS 1.0 Multiple Remote File Inclusion Vulnerabilities | | | +============================================================+ | | | Author : HxH | | | | E-Mail : HxHatlivedotat | | |...
CVE-2009-3248
The CVE-2009-3248 entry describes a CSRF vulnerability in the vtiger CRM 5.0.4 RSS module . The flaw allows remote attackers to hijack the authentication of Admin users by crafting requests to index.php with the rssurl parameter in a Save action, enabling modification of the news feed system. The...
CVE-2008-7243: Cross-Site Request Forgery (CSRF)
Cross-site request forgery CSRF vulnerability in page 34 in MODx CMS 0.9.6.1 and 0.9.6.1p1 allows remote attackers to hijack the authentication of other users for requests that modify passwords via manager/index.php. NOTE: due to the lack of details, it is not clear whether this is related to...
CVE-2008-7242: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in MODx CMS 0.9.6.1 and 0.9.6.1p1 allo remote attackers to inject arbitrary web script or HTML via the 1 search, 2 "a," 3 messagesubject, and 4 messagebody parameters to certain pages as reachable from manager/index.php; 5 highlight, 6 id, 7 email...
Directory traversal
Multiple directory traversal vulnerabilities in iWiccle 1.01, when magicquotesgpc is disabled, allow remote attackers to read arbitrary files via a .. dot dot in 1 the show parameter to the admin module, reachable through index.php; or 2 the module parameter to index.php...
Sql injection
SQL injection vulnerability in index.php in Super Mod System, when using the 68 Classifieds 3.1 Core System, allows remote attackers to execute arbitrary SQL commands via the s parameter...
Sql injection
SQL injection vulnerability in the admin module in iWiccle 1.01 allows remote attackers to execute arbitrary SQL commands via the memberid parameter in an edituser action to index.php...
CVE-2009-3222
CVE-2009-3222 is a cross-site scripting (XSS) vulnerability affecting FreeWebScriptz Honest Traffic (FWSHT) 1.x. The issue is in index.php where a attacker can inject arbitrary web script or HTML via the msg parameter. Public references describe the flaw but do not provide concrete exploitation d...
CVE-2009-3227
The CVE-2009-3227 entry documents a Cross-site scripting (XSS) vulnerability in index.php of AlmondSoft Almond Classifieds Ads Enterprise and Almond Affiliate Network Classifieds. The issue permits remote attackers to inject arbitrary web script or HTML via the city parameter in a search action. ...
CVE-2009-3224
CVE-2009-3224 describes an SQL injection in the web app component: the file index.php of the Super Mod System when used with the 68 Classifieds 3.1 Core System . The vulnerability allows remote attackers to execute arbitrary SQL commands through the s parameter, enabling potential data disclosure...
CVE-2009-3208
Multiple SQL injection vulnerabilities in phpfreeBB 1.0 allow remote attackers to execute arbitrary SQL commands via the 1 id parameter to permalink.php and 2 year parameter to index.php...
CVE-2009-3222: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in index.php in FreeWebScriptz Honest Traffic FWSHT 1.x allows remote attackers to inject arbitrary web script or HTML via the msg parameter...
PaoBacheca 2.1 Cross Site Scripting
/ | | \ \ / / | | \ \ / / | |\ \ /\ / / | | | | | | \ V /| | | \ V V / | | || | || / ||| // ,|, | |/ | | | |/ / | ' \ | | / | | | | | | | |||,|| || || PaoBacheca 2.1 Remote URI XSS Vulnerabilities Discovered By : Moudi Contact : Download : http://zenas.org Greetings : Mizoz, Zuka, str0ke,...
CVE-2009-3224: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in index.php in Super Mod System, when using the 68 Classifieds 3.1 Core System, allows remote attackers to execute arbitrary SQL commands via the s parameter...
CVE-2009-3227: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in index.php in AlmondSoft Almond Classifieds Ads Enterprise and Almond Affiliate Network Classifieds allows remote attackers to inject arbitrary web script or HTML via the city parameter in a search action. NOTE: some of these details are obtained from thir...
CVE-2009-3216: Improper Limitation of a Pathname to a Restricted Directory
Multiple directory traversal vulnerabilities in iWiccle 1.01, when magicquotesgpc is disabled, allow remote attackers to read arbitrary files via a .. dot dot in 1 the show parameter to the admin module, reachable through index.php; or 2 the module parameter to index.php...
CVE-2009-3226: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in index.php in AlmondSoft Almond Classifieds Ads Enterprise and Almond Affiliate Network Classifieds allows remote attackers to execute arbitrary SQL commands via the replid parameter in a manwrepl addform action. NOTE: some of these details are obtained from third...
CVE-2009-3208: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL injection vulnerabilities in phpfreeBB 1.0 allow remote attackers to execute arbitrary SQL commands via the 1 id parameter to permalink.php and 2 year parameter to index.php...
CVE-2009-3217: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in the admin module in iWiccle 1.01 allows remote attackers to execute arbitrary SQL commands via the memberid parameter in an edituser action to index.php...