432 matches found
CVE-2006-1813: Undefined Security Weakness
Directory traversal vulnerability in index.php in phpWebFTP 3.2 and earlier allows remote attackers to read arbitrary files via a .. dot dot in the language parameter...
phpWebFTP index.php language Parameter Local File Inclusion
The remote host is running phpWebFTP, a web-based FTP client written in PHP. The version of phpWebFTP installed on the remote host fails to sanitize user-supplied input to the 'language' parameter of the 'index.php' script before using it in a PHP 'include' function. An unauthenticated attacker m...
CVE-2006-1114
Multiple directory traversal vulnerabilities in Loudblog before 0.42 allow remote attackers to read or include arbitrary files via a .. dot dot and trailing %00 NULL byte in the 1 template and 2 page parameters in a index.php, and the 3 language parameter in b inc/backendsettings.php...
CVE-2006-0802
Cross-site scripting XSS vulnerability in the NS-Languages module for PostNuke 0.761 and earlier, when magicquotesgpc is enabled, allows remote attackers to inject arbitrary web script or HTML via the language parameter in a missing or translation operation...
CVE-2006-0802: Undefined Security Weakness
Cross-site scripting XSS vulnerability in the NS-Languages module for PostNuke 0.761 and earlier, when magicquotesgpc is enabled, allows remote attackers to inject arbitrary web script or HTML via the language parameter in a missing or translation operation...
CVE-2006-0801: Undefined Security Weakness
SQL injection vulnerability in the NS-Languages module for PostNuke 0.761 and earlier, when magicquotesgpc is off, allows remote attackers to execute arbitrary SQL commands via the language parameter to admin.php...
DEBIAN-CVE-2006-0518
Cross-site scripting XSS vulnerability in index.php3 in SPIP 1.8.2-e and earlier and 1.9 Alpha 2 5539 and earlier allows remote attackers to inject arbitrary web script or HTML via the lang parameter...
CVE-2005-4558
IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, does not properly restrict acceptable values for the language parameter to mail/settings.html before it is stored in a database, which can allow remote authenticated users to include...
CVE-2005-4558
IceWarp Web Mail 5.5.1 , integrated into Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1 , is vulnerable to an input validation flaw. The software fails to restrict acceptable values for the language parameter in mail/settings.html before storage in a database. This allows...
CVE-2005-4250
Directory traversal vulnerability in mcGallery PRO 2.2 and earlier allows remote attackers to read arbitrary files via the language parameter...
CVE-2005-4250
Directory traversal vulnerability in mcGallery PRO 2.2 and earlier allows remote attackers to read arbitrary files via the language parameter...
CVE-2005-4250: Undefined Security Weakness
Directory traversal vulnerability in mcGallery PRO 2.2 and earlier allows remote attackers to read arbitrary files via the language parameter...
CVE-2005-1925
Multiple directory traversal vulnerabilities in Tikiwiki before 1.9.1 allow remote attackers to read arbitrary files and execute commands via 1 the suckurl parameter to tiki-editpage.php or 2 language parameter to tiki-userpreferences.php...
CVE-2004-2519: Undefined Security Weakness
Gattaca Server 2003 1.1.10.0 allows remote attackers to cause a denial of service CPU consumption via directory specifiers in the LANGUAGE parameter to 1 index.tmpl and 2 web.tmpl, such as a slash "/", b backslash "", c dot ".",, d dot dot "..", and e internal slash "lang//en"...
CVE-2004-2518: Undefined Security Weakness
Gattaca Server 2003 1.1.10.0 allows remote attackers to obtain sensitive information via 1 a trailing null byte "%00" to a URL or 2 an invalid LANGUAGE parameter to web.tmpl, which reveals the full installation path in an error message...
CVE-2005-2607
The CVE concerns Simplicity oF Upload’s download.php where the language parameter can trigger a local/remote file inclusion (LFI) due to insufficient input sanitization. Affected software is the Simplicity oF Upload PHP script; vulnerability resides in download.php prior to version 1.3.1. Consequ...
CVE-2005-2607
PHP file include vulnerability in download.php in PHPSimplicity Simplicity oF Upload before 1.3.1 allows remote attackers to include arbitrary local and remote files via the language parameter and a terminating null "%00" characters...
CVE-2005-2607
PHP file include vulnerability in download.php in PHPSimplicity Simplicity oF Upload before 1.3.1 allows remote attackers to include arbitrary local and remote files via the language parameter and a terminating null "%00" characters...
CVE-2005-2607: Undefined Security Weakness
PHP file include vulnerability in download.php in PHPSimplicity Simplicity oF Upload before 1.3.1 allows remote attackers to include arbitrary local and remote files via the language parameter and a terminating null "%00" characters...