763 matches found
CVE-2006-2968
Cross-site scripting XSS vulnerability in search.php in PHP Labware LabWiki 1.0 allows remote attackers to inject arbitrary web script or HTML via the search input box query parameter...
[MajorSecurity #14]CFXe-CMS <= 2.0 - XSS
MajorSecurity 14CFXe-CMS = 2.0 - XSS ---------------------------------------------- Software: CFXe-CMS Version: =2.0 Type: Cross site scripting Date: June, 10th 2006 Vendor: Creanet Internet Service AG Page: http://www.cms-cfx.ch Credits: ---------------------------- Discovered by: David...
Cross site scripting
UNVERIFIABLE NOTE: this issue does not contain any verifiable or actionable details. Cross-site scripting XSS vulnerability in Marco M. F. De Santis Php-residence 0.6 and earlier allows remote attackers to inject arbitrary web script or HTML via "any of its input." NOTE: the original disclosure i...
Oi! Email Marketing System 3.0 - 'index.php' SQL Injection
source: https://www.securityfocus.com/bid/16794/info Oi! Email Marketing System is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation could allow an attacker t...
BMForum 3.0 - post.php Cross-Site Scripting
BMForum 3.0 - post.php Cross-Site Scripting source: https://www.securityfocus.com/bid/14396/info BMForum is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage any of these...
Clever Copy 2.0 - categorysearch.php Cross-Site Scripting
Clever Copy 2.0 - categorysearch.php Cross-Site Scripting source: https://www.securityfocus.com/bid/14395/info Clever Copy is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may...
[SA15534] phpThumb() "src" Exposure of Sensitive Information
---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secuniavacancies/...
PHP Advanced Transfer Manager 1.21 - Arbitrary File Inclusion
PHP Advanced Transfer Manager 1.21 - Arbitrary File Inclusion source: https://www.securityfocus.com/bid/13691/info PHP Advanced Transfer Manager is prone to an arbitrary file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An...
phpMyDirectory review.php subcat Parameter XSS
The version of phpMyDirectory installed on the remote host suffers from multiple cross-site scripting vulnerabilities due to its failure to sanitize user input to its 'review.php' script through various parameters. A remote attacker can exploit these flaws to steal cookie-based authentication...
possible SQL injection in Subdreamer
//==========================================// GHC - Subdreamer - ADVISORY // Product: Subdreamer Version: Subdreamer Light // URL: www.subdreamer.com VULNERABILITY CLASS: SQL injection //==========================================// Product Description "Powered by PHP and MySQL, Subdreamer provid...
phpfusionXSS.txt
I found an exploit in the current version of php-fusion which allows you to input XSS in the IMG tag. I reported it already to php-fusion and they created a fix for this. Here it goes: By converting the text ie. javascript:alert'test' to their ascii values, the strings between the img/img tags...
PBLang Bulletin Board System 4.x - SendPM.php Directory Traversal
PBLang Bulletin Board System 4.x - SendPM.php Directory Traversal source: https://www.securityfocus.com/bid/12690/info PBLang is reported prone to a directory traversal vulnerability. It is reported that the issue exists due to a lack of sufficient sanitization performed on user-supplied input. A...
BizMail bizmail.cgi Arbitrary Mail Relay
The remote web server is hosting the CGI bizmail.cgi, a CGI script for sending the content of web forms to email addresses. The remote version of this software fails to sanitize the 'email' parameter to the 'bizmail.cgi' script of CRLF sequences. An unauthenticated, remote attacker may be able to...
[SECURITY] [DSA 631-1] New kdlibs packages fix arbitrary FTP command execution
-------------------------------------------------------------------------- Debian Security Advisory DSA 631-1 [email protected] http://www.debian.org/security/ Martin Schulze January 10th, 2005 http://www.debian.org/security/faq -...
escripts software e_board 4.0 - Directory Traversal
source: https://www.securityfocus.com/bid/12048/info It is reported that eBoard is vulnerable to a directory traversal vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied input. By including '../' directory traversal sequences and a NULL %00 in the...
ABC2MIDI 2004-12-04 - Multiple Stack Buffer Overflow Vulnerabilities
source: https://www.securityfocus.com/bid/12019/info It is reported that abc2midi is susceptible to two stack buffer overflow vulnerabilities. These issues are due to a failure of the application to properly bounds check user-supplied image data prior to copying it into fixed-size memory buffers...
Advanced Guestbook 2.2/2.3 - Cross-Site Scripting
source: https://www.securityfocus.com/bid/11798/info It is reported that Advanced Guestbook is affected by a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input. This issue could permit a remote attacker to create a...
[Full-Disclosure] Click and Build eCommerce Platform Cross Site Scripting
ClickandBuild: http://apply.clickandbuild.com/ Online eCommerce platform. Vulnerability The vulnerability lies in the "listPos" variable in the script running at cashncarrion.co.uk. It does not properly secure user inputted variables, presumably as the user is not supposed to input the variable b...
