2307 matches found
CRS Manager ($DOCUMENT_ROOT) Multi Remote File Include
X---- w w w . u N k n 0 w n . e u ----X CRS Managercrsmanager Multi Remote File Include ::Home: http://crsmanager.berlios.de ::Vuln Type : Remote File Include RFI ::Discovered by : iNs ::Vuln Code: index.php login.php ?php require $DOCUMENTROOT."/../admin/settings/conf.php"; PoC:...
Remote file inclusion
PHP remote file inclusion vulnerability in login.php in MyREFERER 1.08 allows remote attackers to execute arbitrary PHP code via a URL in the value parameter...
CVE-2007-4484
CVE-2007-4484 describes a PHP remote file inclusion vulnerability in My_REFERER 1.08, specifically in login.php where an attacker can cause arbitrary PHP code execution by supplying a URL in the value parameter. The public description confirms the vulnerable component (login.php) and the vulnerab...
CVE-2007-4484: Undefined Security Weakness
PHP remote file inclusion vulnerability in login.php in MyREFERER 1.08 allows remote attackers to execute arbitrary PHP code via a URL in the value parameter...
My_REFERER v.1.08 Remote File Include
App Name : MyREFERER v.1.08 HomePage : http://www.phoenix.frihost.net/referer/readme.php Vuln type : Remote File Include RFI Vulnerability Discovered by : iNs Vuln Code: login.php include"$value"; POC: htttp://site.com/path/login.php?value=SHELL.txt?? iNs @ uNkn0wn.eu Gr33tz t0: uNkn0wn.eu - iD -...
mcLinksCounter 1.2 Remote File Include by iNs
App Name : mcLinksCounter 1.2 HomePage: http://www.phpforums.net Vuln type : Remote File Include RFI Vuln Discovered by : iNs BUG: on file stats.php ,login.php ,detail.php : include "$langfile"; PoC: http://www.site.com/path/stats.php?langfile=sH3lLz? iNs @ uNkn0wn.eu Gr33tz t0: uNkn0wn.eu - iD -...
CVE-2007-4307
Storesprite 7 and earlier suffer multiple XSS vulnerabilities that allow remote attackers to inject arbitrary web script or HTML via the next parameter to addaddress.php, editshipdetails.php, register.php, or login.php in the secure/ path. The affected component is the web application Storesprite...
PhpHostBot Login.PHP远程文件包含漏洞
PhpHostBot是一款基于PHP的WEB应用程序。 PhpHostBot不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以应用程序进程权限执行任意命令。 问题是由于'Login.PHP'脚本对用户提交的'svrrootscript'参数缺少过滤，提交远程服务器上的任意PHP文件作为包含对象，可导致以WEB权限执行任意PHP代码。 PhpHostBot 1.06 目前没有解决方案提供： http://www.idevspot.com/PhpHostBot.php...
Unfixed XSS vulnerability at www.eetechbrief.com
Security researcher Narcoticxs, has submitted on 08/08/2007 a cross-site-scripting XSS vulnerability affecting www.eetechbrief.com, which at the time of submission ranked 8475386 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 10/08/2007. It is...
CVE-2007-4231: Undefined Security Weakness
PHP remote file inclusion vulnerability in order/login.php in IDevSpot PhpHostBot 1.06 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the svrrootscript parameter, a different vector than CVE-2007-4094 and CVE-2006-3776...
CVE-2007-4021
Multiple cross-site scripting XSS vulnerabilities in login.php in Brain Book Software Secure 1.0.20070629 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 user and 2 pwd parameters...
CVE-2007-4021
CVE-2007-4021 affects Brain Book Software Secure 1.0.20070629 and earlier. The vulnerability is multiple XSS in login.php, exploitable via the (1) user and (2) pwd parameters, enabling remote attackers to inject arbitrary script/HTML into victims’ browsers. Root cause: reflected XSS in login hand...
CVE-2007-4020: Undefined Security Weakness
Multiple cross-site scripting XSS vulnerabilities in login.php in AdMan 1.0.20051202 FF 3 patch and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 user and 2 pwd parameters...
CVE-2007-4021: Undefined Security Weakness
Multiple cross-site scripting XSS vulnerabilities in login.php in Brain Book Software Secure 1.0.20070629 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 user and 2 pwd parameters...
CVE-2007-3627
Multiple SQL injection vulnerabilities in PHP Lite Calendar Express 2.2 allow remote attackers to execute arbitrary SQL commands via the cid parameter to 1 login.php, 2 auth.php, and 3 subscribe.php. NOTE: the month.php, year.php, week.php, and day.php vectors are already covered by CVE-2005-4009...
Directory traversal
Directory traversal vulnerability in login.php in Maia Mailguard 1.0.2 and earlier allows remote attackers to read arbitrary files via a .. dot dot in the lang parameter...
CVE-2007-3627: Undefined Security Weakness
Multiple SQL injection vulnerabilities in PHP Lite Calendar Express 2.2 allow remote attackers to execute arbitrary SQL commands via the cid parameter to 1 login.php, 2 auth.php, and 3 subscribe.php. NOTE: the month.php, year.php, week.php, and day.php vectors are already covered by CVE-2005-4009...
CVE-2007-3619: Undefined Security Weakness
Directory traversal vulnerability in login.php in Maia Mailguard 1.0.2 and earlier allows remote attackers to read arbitrary files via a .. dot dot in the lang parameter...
CVE-2007-3557: Undefined Security Weakness
SQL injection vulnerability in admin/login.php in Wheatblog wB 1.1, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the login parameter...