214 matches found
Sql injection
Multiple SQL injection vulnerabilities in main.php in the WassUp plugin 1.4 through 1.4.3 for WordPress allow remote attackers to execute arbitrary SQL commands via the 1 fromdate or 2 todate parameter to spy.php...
Wordpress Plugin WassUp 1.4.3 (spy.php to_date) SQL Injection Exploit
No description provided by source. ? WordPress WassUp plugin v 1.4.3 Sql Injection Exploit Plugin Homepage-http://www.wpwp.org/ Found by:enterthedragon Tested successfully on v 1.4-1.4.3 lower versions are possibly vulnerable too just check the source and modify the query as needed Vuln code -In...
CVE-2007-6471
Incomplete blacklist vulnerability in main.php in phPay 2.02.01 on Windows allows remote attackers to conduct directory traversal attacks and include and execute arbitrary local files via a ..\ dot dot backslash in the config parameter...
Directory traversal
Incomplete blacklist vulnerability in main.php in phPay 2.02.01 on Windows allows remote attackers to conduct directory traversal attacks and include and execute arbitrary local files via a ..\ dot dot backslash in the config parameter...
CVE-2007-6011
Unspecified vulnerability in main.php of BugHotel Reservation System before 4.9.9 P3 allows remote attackers to bypass authentication and gain administrative access via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...
CVE-2007-5948
Multiple cross-site scripting XSS vulnerabilities in main.php in SF-Shoutbox 1.2.1 through 1.4 allow remote attackers to inject arbitrary web script or HTML via the 1 nick aka Name and 2 shout aka Shout parameters...
Remote file inclusion
Multiple PHP remote file inclusion vulnerabilities in GoSamba 1.0.1 allow remote attackers to execute arbitrary PHP code via a URL in the includepath parameter to 1 HTMLoben.php, 2 incfreigabe.php, 3 incfreigabe1.php, or 4 incfreigabe3.php in include/; 5 incgroup.php; 6 incmanager.php; 7...
Scott Manktelow Design Stride 1.0 - 'Content Management System main.php' SQL Injection
source: https://www.securityfocus.com/bid/26041/info Scott Manktelow Design Stride 1.0 Content Management System is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker t...
CVE-2007-4306
Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 2.10.3 allow remote attackers to inject arbitrary web script or HTML via the 1 unlimnumrows, 2 sqlquery, or 3 pos parameter to a tblexport.php; the 4 sessionmaxrows or 5 pos parameter to b sql.php; the 6 username parameter to c...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 2.10.3 allow remote attackers to inject arbitrary web script or HTML via the 1 unlimnumrows, 2 sqlquery, or 3 pos parameter to a tblexport.php; the 4 sessionmaxrows or 5 pos parameter to b sql.php; the 6 username parameter to c...
CVE-2007-4170
Multiple PHP remote file inclusion vulnerabilities in AL-Athkar 2.0 allow remote attackers to execute arbitrary PHP code via a URL in the 1 include parameter to a Main.php and b get.php and the 2 exec parameter to c count.php...
paBugs 2.0 Beta 3 - main.php?cid SQL Injection
paBugs 2.0 Beta 3 - main.php?cid SQL Injection !/usr/bin/perl use LWP::UserAgent; use HTTP::Cookies; if@ARGV get$sql or err; $res - content = /0-9,a-f32/ or err; print "\n + Admin Passwordmd5=$usid is: $1 \n\n"; sub usage print "---------------------------------------------------------\n"; print ...
paBugs 2.0 Beta 3 - 'main.php?cid' SQL Injection
!/usr/bin/perl use LWP::UserAgent; use HTTP::Cookies; if@ARGV get$sql or err; $res - content = /0-9,a-f32/ or err; print "\n + Admin Passwordmd5=$usid is: $1 \n\n"; sub usage print "---------------------------------------------------------\n"; print "| Bug Found by: umpi |\n"; print...
CVE-2006-7127
Multiple PHP remote file inclusion vulnerabilities in JAF CMS 4.0 and 4.0 RC2 allow remote attackers to execute arbitrary PHP code via a URL in the maindir parameter to 1 forum/main.php and 2 forum/headlines.php...
CVE-2007-1231
Multiple cross-site scripting XSS vulnerabilities in SQLiteManager 1.2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 database name, 2 table name, 3 ViewName, 4 view, 5 trigger, and 6 function fields in main.php and certain other files...
vhostadmin 0.1 (MODULES_DIR) Remote File Inclusion Vulnerability
Exploit for unknown platform in category web applications ================================================================ vhostadmin 0.1 MODULESDIR Remote File Inclusion Vulnerability ================================================================ | | \ | Dr Max Virus | / \ | | / / || \ / ...
Fully Modded phpBB <= 2021.4.40 Multiple File Include Vulnerabilities
Exploit for unknown platform in category web applications ===================================================================== Fully Modded phpBB = 2021.4.40 Multiple File Include Vulnerabilities ===================================================================== Fully Modded phpBB 2 Remote Fi...
kawf (config) Remote File Include
kawf config Remote File Include --------------------------------------------------------------------------------------------- Kawf is a web forum written in PHP4 using MySQL v. 1.0 and all below -------------------------------------------------------------------------------------------- download ...
kawf <= 1.0 (main.php) Remote File Include Vulnerability
No description provided by source. kawf config Remote File Include --------------------------------------------------------------------------------------------- Kawf is a web forum written in PHP4 using MySQL v. 1.0 and all below...