Phorum 3.x - profile.php?target Cross-Site Scripting

Phorum 3.x - profile.php?target Cross-Site Scripting source: https://www.securityfocus.com/bid/9882/info It has been reported that Phorum is prone to a cross-site scripting vulnerability across multiple modules. The issue presents itself across multiple modules including 'login.php',...

Phorum 5.0.3 Beta - Cross Site Scripting

Phorum 5.0.3 Beta - Cross Site Scripting Phorum Cross Site Scripting Vendor: Phorum Product: Phorum Version: tag, it will allow for pretty much any thing else, and most of you know it is not hard to execute javascript inside of a tag which is allowed. This same vulnerability also exists in...

Phorum 3.x - 'login.php' HTTP_REFERER Cross-Site Scripting

source: https://www.securityfocus.com/bid/9882/info It has been reported that Phorum is prone to a cross-site scripting vulnerability across multiple modules. The issue presents itself across multiple modules including 'login.php', 'register.php', and 'profile.php'. These modules employ two hidde...

CVE-2004-0034

Multiple cross-site scripting XSS vulnerabilities in Phorum 3.4.5 and earlier allow remote attackers to inject arbitrary HTML or web script via 1 the phorumcheckxss function in common.php, 2 the EditError variable in profile.php, and 3 the Error variable in login.php...

CVE-2004-0067

CVE-2004-0067 describes multiple cross-site scripting (XSS) vulnerabilities in phpGedView prior to 2.65. The issue allows remote attackers to inject arbitrary HTML or JavaScript through numerous PHP/WEB pages (e.g., descendancy.php, index.php, individual.php, login.php, relationship.php, source.p...

CVE-2003-1466

Unspecified vulnerability in Phorum 3.4 through 3.4.2 allows remote attackers to use Phorum as a connection proxy to other sites via 1 register.php or 2 login.php...

SudBox Boutique 1.2 - login.php Authentication Bypass

SudBox Boutique 1.2 - login.php Authentication Bypass source: https://www.securityfocus.com/bid/7651/info A vulnerability has been reported for SudBox Boutique. The problem occurs due to insufficient initialization of variables and may allow an unauthorized user to gain authenticate. Specifically...

Py-Membres 4.0 - SQL Injection

source: https://www.securityfocus.com/bid/7301/info A vulnerability has been reported for Py-Membres 4.0 that allows remote attackers to modify the logic of SQL queries. It has been reported that an input validation error exists in the login.php file included with Py-Membres. Because of this, a...

CVE-2002-0995

login.php for PHPAuction allows remote attackers to gain privileges via a direct call to login.php with the action parameter set to "insert," which adds the provided username to the adminUsers table...

CVE-2002-0995

PHPAuction's login.php is vulnerable: a direct call with action=insert allows remote attackers to add a username to the adminUsers table, effectively gaining privileges. The CVE entry documents this privilege escalation and labels it high severity (CVSS v2 base score 7.5). The provided sources co...

phpAuction 12 - Unauthorized Administrative Access

phpAuction 12 - Unauthorized Administrative Access source: https://www.securityfocus.com/bid/5141/info PhpAuction is a freely available web-based auction system. It is written using PHP scripting language on a MySQL database engine. A flaw in /admin/login.php has been reported in PHPAuction, whic...