Cross site scripting

Cross-site scripting XSS vulnerability in index.php in JCE-Tech PHP Video Script allows remote attackers to inject arbitrary web script or HTML via the key parameter...

CVE-2009-3194

Cross-site scripting XSS vulnerability in index.php in JCE-Tech SearchFeed Script allows remote attackers to inject arbitrary web script or HTML via the search parameter...

CVE-2009-3184

Multiple SQL injection vulnerabilities in index.php in Pirates of The Caribbean in the E-Gold Game Series allow remote attackers to execute arbitrary SQL commands via the 1 x and 2 y parameters...

CVE-2009-3194

Cross-site scripting (XSS) vulnerability identified as CVE-2009-3194 affects the JCE-Tech SearchFeed Script’s index.php. The issue allows remote attackers to inject arbitrary web script or HTML via the search parameter. Public references in the NVD entry indicate an XSS with a base score of 4.3 (...

CVE-2009-3192: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in index.php in LinkorCMS 1.2 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the searchstr parameter in a search action; or the 2 nikname, 3 realname, 4 homepage, or 5 city parameter in a registration action...

CVE-2009-3196: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in JCE-Tech PHP Video Script allows remote attackers to inject arbitrary web script or HTML via the key parameter...

CVE-2009-3184: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in index.php in Pirates of The Caribbean in the E-Gold Game Series allow remote attackers to execute arbitrary SQL commands via the 1 x and 2 y parameters...

CVE-2009-3194: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in JCE-Tech SearchFeed Script allows remote attackers to inject arbitrary web script or HTML via the search parameter...

Sql injection

SQL injection vulnerability in index.php in the Recipes module 1.3, 1.4, and possibly other versions for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the recipeid parameter...

CVE-2008-7223: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in LinPHA before 1.3.3 allow remote attackers to inject arbitrary web script or HTML via 1 ftp/index.php, 2 viewer.php, 3 functions/other.php, 4 include/leftmenu.class.php, or 5 plugins/stats/statsview.php...

CVE-2009-3167

CVE-2009-3167 affects Anantasoft Gazelle CMS 1.0. A directory traversal flaw in index.php allows reading arbitrary files via a .. sequence in the template parameter when magic_quotes_gpc is disabled. This is a server-side input handling issue in the template parameter, enabling potential exposure...

CVE-2009-3167: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in Anantasoft Gazelle CMS 1.0, when magicquotesgpc is disabled, allows remote attackers to read arbitrary files via a .. dot dot in the template parameter...

Sql injection

SQL injection vulnerability in index.php in Multi Website 1.5 allows remote attackers to execute arbitrary SQL commands via the Browse parameter in a vote action...

CVE-2009-3152: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in becommunity/community/index.php in NTSOFT BBS E-Market Professional allow remote attackers to inject arbitrary web script or HTML via the 1 page, 2 btcode, and 3 bno parameters in a board view action...

CVE-2009-3150: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in Multi Website 1.5 allows remote attackers to execute arbitrary SQL commands via the Browse parameter in a vote action...

Nullam Blog 0.1.2 LFI / XSS / SQL Injection

-- Salvatore Fresta aka drosophila CWNP444351 Salvatore "drosophila" Fresta + Application: Nullam Blog + Version: 0.1.2 + Website: http://nullam.net/ + Bugs: A Local File Inclusion B File Disclosure C Multiple Blind SQL Injection D SQL Injection E Reflected XSS + Exploitation: Remote + Date: 10 S...

T-HTB Manager 0.5 - Multiple Blind SQL Injections

T-HTB Manager 0.5 - Multiple Blind SQL Injections Salvatore "drosophila" Fresta + Application: T-HTB Manager + Version: 0.5 + Website: http://sourceforge.net/apps/mediawiki/t-htbmanager/index.php?title=MainPage + Bugs: A Multiple Blind SQL Injection + Exploitation: Remote + Date: 10 Sep 2009 +...

CVE-2009-3154: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the Almond Classifieds comaclassf component 7.5 for Joomla! allows remote attackers to execute arbitrary SQL commands via the replid parameter in a manwrepl addform action to index.php, a different vector than CVE-2009-2567...

Sql injection

SQL injection vulnerability in index.php in Uiga Church Portal allows remote attackers to execute arbitrary SQL commands via the year parameter in a calendar action...

CVE-2009-3116

CVE-2009-3116 is a SQL injection in the Uiga Church Portal, affecting the index.php calendar action where the year parameter can be manipulated to execute arbitrary SQL. The vulnerability is remote-exploitable with high impact (CVSS v2 base 7.5; Confidentiality, Integrity, and Availability partia...