MercuryBoard 1.1.5 - login.php Blind SQL Injection

MercuryBoard 1.1.5 - login.php Blind SQL Injection settitle$this-lang-loginheader; 55. $this-tree$this-lang-loginheader; 56. 57. //print "agent: $this-agent\n"; 58. 59. if !isset$this-post'submit' 60. $requesturi = $this-geturi; 61. 62. if substr$requesturi, -8 == 'register' 63. $requesturi =...

Sql injection

SQL injection vulnerability in login.php in EQdkp 1.3.2f allows remote attackers to bypass EQdkp user authentication via the userid parameter...

CVE-2008-2222

CVE-2008-2222 describes an SQL injection vulnerability in EQdkp 1.3.2f, specifically in login.php, allowing remote attackers to bypass user authentication via the user_id parameter. The affected software is EQdkp 1.3.2f; the root cause is improper input handling in the login flow that enables SQL...

CVE-2008-2222

SQL injection vulnerability in login.php in EQdkp 1.3.2f allows remote attackers to bypass EQdkp user authentication via the userid parameter...

CVE-2008-2222: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in login.php in EQdkp 1.3.2f allows remote attackers to bypass EQdkp user authentication via the userid parameter...

CVE-2008-2224: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in SazCart 1.5.1, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the 1 sazsettingssitedir parameter to layouts/default/header.saz.php and the 2 sazsettingssiteurl parameter to...

CVE-2008-2037: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in EditeurScripts EsContacts 1.0 allow remote authenticated users to inject arbitrary web script or HTML via the msg parameter to 1 login.php, 2 importer.php, 3 addgroupe.php, 4 contacts.php, 5 groupes.php, and 6 search.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in login.php in Omnistar Interactive OSI Affiliate allow remote attackers to inject arbitrary web script or HTML via the 1 login, 2 profile, 3 profile2, and 4 ref parameters...

CVE-2008-1850

The CVE-2008-1850 entry describes multiple cross-site scripting (XSS) vulnerabilities in the login.php component of Omnistar Interactive OSI Affiliate. The underlying issue is improper handling of user-supplied parameters (login, profile, profile2, ref), allowing remote attackers to inject arbitr...

CVE-2008-1850: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in login.php in Omnistar Interactive OSI Affiliate allow remote attackers to inject arbitrary web script or HTML via the 1 login, 2 profile, 3 profile2, and 4 ref parameters...

Sql injection

SQL injection vulnerability in login.php in CuteFlow 1.5.0 and 2.10.0 allows remote attackers to execute arbitrary SQL commands via the UserId parameter, related to the login form field in index.php...

CVE-2008-1631

CVE-2008-1631 corresponds to a SQL injection vulnerability in CuteFlow versions 1.5.0 and 2.10.0. The flaw occurs in login.php, related to the UserId parameter used by the login form (indexed in index.php), allowing remote attackers to craft arbitrary SQL commands. Multiple sources (NVD entry, CV...

CVE-2008-1651: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in admin/login.php in EasyNews 4.0 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the lang parameter...

CVE-2008-1631: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in login.php in CuteFlow 1.5.0 and 2.10.0 allows remote attackers to execute arbitrary SQL commands via the UserId parameter, related to the login form field in index.php...

CVE-2008-1493

Directory traversal vulnerability in login.php in Cuteflow Bin 1.5.0 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the language parameter...

CVE-2008-1493

CVE-2008-1493 affects Cuteflow Bin 1.5.0 in login.php. The language parameter is processed insecurely, enabling directory traversal with ".." to include and execute local files. This has potential partial impact to confidentiality, integrity, and availability (CVSS v2 base score 7.5, AV:N/AC:L/Au...

CVE-2008-1493: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in login.php in Cuteflow Bin 1.5.0 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the language parameter...

cuteflowbin-lfi.txt

Cuteflow Bin v1.5.0 Local File Inclusion Vulnerability + Author : KnocKout + Cyber-Warrior.org / Bug Researchers Group Special Thanks : CW ALL USERS / Mr.Freeman ============================================== Script : Cuteflow Bin v1.5.0 Download :...

CVE-2008-1464: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Gallarific Free Edition 1.1 allow remote attackers to execute arbitrary SQL commands via the 1 query parameter to a search.php; 2 gusername and 3 gpassword parameters to b login.php; and the 4 username and 5 password parameters to c gadmin/index.php in a...

Cuteflow Bin 1.5.0 (login.php) Local File Inclusion Vulnerability

Exploit for unknown platform in category web applications ================================================================= Cuteflow Bin 1.5.0 login.php Local File Inclusion Vulnerability ================================================================= Cuteflow Bin v1.5.0 Local File Inclusion...