104 matches found
CVE-2005-1017
SQL injection vulnerability in the UpdateEvents function in eventsfunctions.asp in MaxWebPortal 1.33 and earlier allows remote attackers to execute arbitrary SQL commands via the EVENTID parameter, as demonstrated using events.asp...
CVE-2005-1016
CVE-2005-1016 affects MaxWebPortal
CVE-2005-1017
CVE-2005-1017 affects MaxWebPortal versions up to 1.33, where the Update_Events function in events_functions.asp is vulnerable to SQL injection via the EVENT_ID parameter (as demonstrated using events.asp). This can allow remote attackers to execute arbitrary SQL commands. The connected sources c...
[SA14752] MaxWebPortal SQL Injection and Script Insertion Vulnerabilities
---------------------------------------------------------------------- Want a new IT Security job? Vacant positions at Secunia: http://secunia.com/secuniavacancies/ ---------------------------------------------------------------------- TITLE: MaxWebPortal SQL Injection and Script Insertion...
MaxWebPortal <= 1.33 Multiple Vulnerabilities
The remote host is running a version of MaxWebPortal that is prone to multiple input validation vulnerabilities: - Multiple SQL Injection Vulnerabilities An attacker can inject SQL statements via various scripts to manipulate database queries. - A Cross-Site Scripting Vulnerability An attacker ca...
MaxWebPortal < 1.36 XSS and SQL Injection Vulnerabilities
Binary data 2783.prm...
CVE-2004-0272
SQL injection vulnerability in MaxWebPortal allows remote attackers to inject arbitrary SQL code and gain sensitive information via the SendTo parameter in Personal Messages...
CVE-2004-0271
Multiple cross-site scripting vulnerabilities XSS in MaxWebPortal allow remote attackers to execute arbitrary web script as other users via 1 the subname parameter of dlshowall.asp, 2 the SendTo parameter in Personal Messages, 3 the HTTPREFERER for down.asp, or 4 the image name of an Avatar in th...
CVE-2004-0271
Multiple cross-site scripting vulnerabilities XSS in MaxWebPortal allow remote attackers to execute arbitrary web script as other users via 1 the subname parameter of dlshowall.asp, 2 the SendTo parameter in Personal Messages, 3 the HTTPREFERER for down.asp, or 4 the image name of an Avatar in th...
CVE-2004-0272
SQL injection vulnerability in MaxWebPortal allows remote attackers to inject arbitrary SQL code and gain sensitive information via the SendTo parameter in Personal Messages...
CVE-2004-0271
CVE-2004-0271 concerns multiple cross-site scripting (XSS) vulnerabilities in MaxWebPortal. The issues enable remote attackers to run arbitrary web script in the context of other users by manipulating: (1) sub_name in dl_showall.asp, (2) SendTo in Personal Messages, (3) HTTP_REFERER for down.asp,...
CVE-2004-0272
CVE-2004-0272 describes an SQL injection vulnerability in MaxWebPortal that allows remote attackers to inject arbitrary SQL via the SendTo parameter in Personal Messages, potentially exposing sensitive information. The NVD reports a CVSS v2 base score of 7.5 (HIGH) with network access, low attack...
Maxwebportal 1.3x - Personal Message SendTo Cross-Site Scripting
Maxwebportal 1.3x - Personal Message SendTo Cross-Site Scripting source: https://www.securityfocus.com/bid/9625/info It has been reported that MaxWebPortal may be prone to multiple vulnerabilities due to insufficient sanitization of user-supplied input. The specific issues include cross-site...
XSS, Sql Injection and Avatar ScriptCode Injection in MaxWebPortal
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Title: XSS, Sql Injection and Avatar ScriptCode Injection in MaxWebPortal By: Manuel Lpez Vendor Description: MaxWebPortal is a web portal and online community system which includes advanced features such as web-based administration, poll,...
Maxwebportal 1.3x - 'down.asp' HTTP_REFERER Cross-Site Scripting
source: https://www.securityfocus.com/bid/9625/info It has been reported that MaxWebPortal may be prone to multiple vulnerabilities due to insufficient sanitization of user-supplied input. The specific issues include cross-site scripting, HTML injection and SQL injection. MaxWebPortal versions...
Maxwebportal 1.3x - down.asp HTTP_REFERER Cross-Site Scripting
Maxwebportal 1.3x - down.asp HTTPREFERER Cross-Site Scripting source: https://www.securityfocus.com/bid/9625/info It has been reported that MaxWebPortal may be prone to multiple vulnerabilities due to insufficient sanitization of user-supplied input. The specific issues include cross-site...
Maxwebportal 1.3x - Personal Message 'SendTo' Cross-Site Scripting
source: https://www.securityfocus.com/bid/9625/info It has been reported that MaxWebPortal may be prone to multiple vulnerabilities due to insufficient sanitization of user-supplied input. The specific issues include cross-site scripting, HTML injection and SQL injection. MaxWebPortal versions...
CVE-2003-1213
The default installation of MaxWebPortal 1.30 stores the portal database under the web document root with insecure access control, which allows remote attackers to obtain sensitive information via a direct request to database/db2000.mdb...
CVE-2003-1211
Cross-site scripting XSS vulnerability in search.asp for MaxWebPortal 1.30 and possibly earlier versions allows remote attackers to inject arbitrary web script or HTML via the Search parameter...