DeltaScripts PHP Links 1.0 Cross Site Scripting

H A C K - T E C H E X P L O I T S - by Crux + Exploit Title: DeltaScripts PHP Links XSS Vulnerability + Date: January 09 2010 + Author: Crux mail:[email protected] + Software Link: http://www.deltascripts.com/phplinks/ + Version: 1.0 + Tested on: ALL OS + Dork: NO NO NO! Vulnerable File...

dedecms <=5.7 member-login.php 跨站脚本攻击漏洞

No description provided by source...

WordPress 1.2 wp-login.php响应拆分攻击漏洞

No description provided by source...

phpGroupWare多个输入验证漏洞

BUGTRAQ ID: 35761 CVE ID: CVE-2009-4414,CVE-2009-4415,CVE-2009-4416 phpGroupWare是一个用PHP编写的多用户的网络组件，为开发其他程序提供了一个API。 phpGroupWare的多个组件中存在输入验证错误，远程攻击者可以通过提交恶意请求泄露敏感信息、执行跨站脚本或SQL注入攻击。 1 没有正确地验证传送给csvfile参数的输入便在addressbook/csvimport.php中使用，这可能导致在受影响系统上读取任意文件的内容。 2...

CVE-2009-4416

Cross-site scripting XSS vulnerability in login.php in phpGroupWare 0.9.16.12, and possibly other versions before 0.9.16.014, allows remote attackers to inject arbitrary web script or HTML via an arbitrary parameter whose name begins with the "phpgw" sequence...

Pligg login.php return Parameter Arbitrary Site Redirect

The remote host is running Pligg, an open source content management system. The installed version of Pligg contains an open redirect, in the 'return' parameter of its 'login.php' script. This could be abused to launch a phishing attack to trick users into visiting malicious sites. Note that this...

Sql injection

SQL injection vulnerability in login.php in sample code in the XenServer Resource Kit in Citrix XenCenterWeb allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: some of these details are obtained from third party information...

CVE-2009-3758

CVE-2009-3758 is a SQL injection in login.php of the XenServer Resource Kit / XenCenterWeb. The vulnerability allows remote attackers to execute arbitrary SQL commands via the username parameter, as described in NVD/NIST and mirrored in multiple sources. Public exploit coverage is indicated by a ...

CVE-2009-3422

login.php in Zenas PaoLiber 1.1, when registerglobals is enabled, allows remote attackers to bypass authentication and gain administrative access by setting the loginok parameter to 1...

Authentication flaw

login.php in Zenas PaoLink 1.0, when registerglobals is enabled, allows remote attackers to bypass authentication and gain administrative access by setting the loginok parameter to 1...

CVE-2009-3423

login.php in Zenas PaoLink 1.0, when registerglobals is enabled, allows remote attackers to bypass authentication and gain administrative access by setting the loginok parameter to 1...

CVE-2009-3430

The CVE-2009-3430 entry concerns Allomani Mobile 2.5, where a SQL injection flaw in login.php allows remote attackers to manipulate the database by supplying crafted input in the username field during login. The vulnerability is caused by unsafely handling user input in the login action, enabling...

CVE-2009-3423

CVE-2009-3423 affects Zenas PaoLink 1.0. When login_globals is enabled, an attacker can bypass authentication by setting the login_ok parameter to 1 in login.php, gaining administrative access. The NVD entry records a CVSSv2 base score of 6.8 (MEDIUM) with network attack vector and no authenticat...

CVE-2009-3422

login.php in Zenas PaoLiber 1.1, when registerglobals is enabled, allows remote attackers to bypass authentication and gain administrative access by setting the loginok parameter to 1...

CVE-2009-3421

CVE-2009-3421 affects Zenas PaoBacheca Guestbook 2.1. The vulnerability is in login.php and arises when PHP register_globals is enabled. An attacker can bypass authentication and gain administrative access by setting the login_ok parameter to 1. The NVD notes a high-severity impact (confidentiali...

CVE-2009-3327

Multiple SQL injection vulnerabilities in WX-Guestbook 1.1.208 allow remote attackers to execute arbitrary SQL commands via the 1 QUERY parameter to search.php and 2 USERNAME parameter to login.php. NOTE: some of these details are obtained from third party information...

PHP168 6.0及以下版本login.php存在重大安全漏洞

PHP168整站系统一直以来受广大用户的亲睐，它凭借着自身的强大、稳定、安全、灵活、易用等多方面的优势 ... 架构与功能的不断完善，让PHP168成为了最主流CMS系统之一。 login.php参数处理不当，入侵者可以在用户登陆页面构造特殊语句，将PHP一句话写入cache目录，从而获得使用PHP168整站程序网站的WEBSHELL权限。 PHP168 6.0以下版本 暂无 等待官方补丁 login.php?makehtml=1&chdbhtmlname=honker.php&chdbpath=cache&content=?php%20@eval$POSThonker;?...

Property Watch 2.0 Cross Site Scripting

/ | | \ \ / / | | \ \ / / | |\ \ /\ / / | | | | | | \ V /| | | \ V V / | | || | || / ||| // ,|, | |/ | | | |/ / | ' \ | | / | | | | | | | |||,|| || || Property Watch v2.0 Remote XSS Vulnerabilities Discovered By : Moudi Contact : Download : http://www.propertywatchscript.com/ Greetings :...

CVE-2009-2928

CVE-2009-2928 is an XSS vulnerability in TGS Content Management 0.x, specifically in login.php, where the parameter previous_page can inject arbitrary script/HTML. This entry is supported by NVD details (description of XSS via previous_page) and does not include explicit exploit status or a publi...

CVE-2009-2921

Multiple SQL injection vulnerabilities in login.php in MOC Designs PHP News 1.1 allow remote attackers to execute arbitrary SQL commands via the 1 newsuser parameter User field and 2 newspassword parameter Password field...