255 matches found
CVE-2007-5918
CVE-2007-5918 is a CSRF vulnerability in the MS TopSites add-on for PHP-Nuke. The flaw occurs in edit.php where the uname parameter is not verified against the current account, allowing a remote authenticated user to change arbitrary accounts or modify the SiteTitleName by supplying a modified un...
CVE-2003-1340: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL injection vulnerabilities in Francisco Burzi PHP-Nuke 5.6 and 6.5 allow remote authenticated users to execute arbitrary SQL commands via 1 a uid user cookie to modules.php; and allow remote attackers to execute arbitrary SQL commands via an aid admin cookie to the WebLinks module in ...
CVE-2007-4253
CVE-2007-4253 affects Envolution (News module, pages.php) with a SQL injection vulnerability exposed via the topic parameter in News 1.1.0 and earlier. The root cause is unsafely constructed SQL leading to arbitrary SQL execution by remote attackers. Connected documents confirm the same vulnerabi...
Web Slider 0.6 - 'path' Remote File Inclusion
Web Slider 0.6pathRemote File Inclusion Vulnerabilities D.Script: http://sourceforge.net/projects/webslider/ Discovered by: GolDM = Mahmoodali Homepage: http://Www.Tryag.Com/cc Exploit:Path/index.php?path=Shell Exploit:Path/modules/pdf.php?path=Shell Exploit:Path/plugins/highlight.php?path=Shell...
CVE-2007-1519: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in modules.php in PHP-Nuke 8.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the query parameter in a search operation in the Downloads module, a different product than CVE-2006-3948...
Sql injection
SQL injection vulnerability in the category file in modules.php in the Emporium 2.3.0 and earlier module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the categoryid parameter...
CVE-2007-1034: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in the category file in modules.php in the Emporium 2.3.0 and earlier module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the categoryid parameter...
gallery-rfi.txt
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Gallery = 1.4.4-pl4 phpbbrootpath Remote File Include Vulnerability Script : Gallery Version : 1.4.4-pl4 URL : http://puzzle.dl.sourceforge.net/sourceforge/gallery/gallery-1.6-alpha3.tar.gz Author : BorN To K!LL...
CVE-2007-0372: Undefined Security Weakness
Multiple SQL injection vulnerabilities in Francisco Burzi PHP-Nuke 7.9 allow remote attackers to execute arbitrary SQL commands via 1 the active parameter in admin/modules/modules.php; the 2 adclass, 3 imageurl, 4 clickurl, 5 adcode, or 6 position parameter in modules/Advertising/admin/index.php;...
CVE-2006-6534: Undefined Security Weakness
Multiple cross-site scripting XSS vulnerabilities in osCommerce 3.0a3 allow remote attackers to inject arbitrary web script or HTML via the 1 set parameter to admin/modules.php, the 2 selectedbox parameter to definitiva/admin/customers.php, the 3 lID parameter to admin/languagesdefinitions.php, o...
oscommerce-xss.txt
Oscommerce Multiple XSS in admin section. Vendor url:Http://www.oscommerce.com Advisore:http://lostmon.blogspot.com/2006/11/ oscommerce-multiple-xss-in-admin.html Vendor notify:YES Exploit available: YES osCommerce contains a flaw that allows a remote cross site scripting attack.This flaw exists...
CVE-2006-5565
CRLF injection vulnerability in MAXdev MD-Pro 1.0.76 allows remote attackers to inject arbitrary HTTP headers via a CRLF sequence in the 1 name, 2 file, 3 module, and 4 func parameters in a index.php; and the 5 file parameter in b modules.php. NOTE: the provenance of this information is unknown;...
CVE-2006-5565: Undefined Security Weakness
CRLF injection vulnerability in MAXdev MD-Pro 1.0.76 allows remote attackers to inject arbitrary HTTP headers via a CRLF sequence in the 1 name, 2 file, 3 module, and 4 func parameters in a index.php; and the 5 file parameter in b modules.php. NOTE: the provenance of this information is unknown;...
CVE-2006-5525: Undefined Security Weakness
Incomplete blacklist vulnerability in mainfile.php in PHP-Nuke 7.9 and earlier allows remote attackers to conduct SQL injection attacks via 1 "//UNION " or 2 " UNION//" sequences, which are not rejected by the protection mechanism, as demonstrated by a SQL injection via the eid parameter in a...
CVE-2006-3948
Cross-site scripting XSS vulnerability in modules.php in PHP-Nuke INP allows remote attackers to inject arbitrary web script or HTML via the query parameter...
CVE-2006-3948: Undefined Security Weakness
Cross-site scripting XSS vulnerability in modules.php in PHP-Nuke INP allows remote attackers to inject arbitrary web script or HTML via the query parameter...
PHP-Nuke - INP modules.php Cross-Site Scripting
PHP-Nuke - INP modules.php Cross-Site Scripting source: https://www.securityfocus.com/bid/19208/info PHPNuke INP is prone to a cross-site scripting vulnerability that affects the 'modules.php' script. The specific version affected is currently unknown...
PHP-Nuke - 'INP modules.php' Cross-Site Scripting
source: https://www.securityfocus.com/bid/19208/info PHPNuke INP is prone to a cross-site scripting vulnerability that affects the 'modules.php' script. The specific version affected is currently unknown. http://www.example.com/path/modules.php?name=Downloads&op=search&query=alert'ARIA'...
SQuery 4.5 - 'gore.php' Remote File Inclusion
================================================================= SQuery = 4.5libpath Remote File Inclusion Exploit ================================================================= Worked On : ALL VERSIONS | | Critical Level : Dangerous | | Gug Found In : gore.php |...