CVE-2006-6403

CVE-2006-6403 affects mystats.php in MyStats 1.0.8 and earlier. The issue allows remote attackers to obtain the installation path via (1) details and (2) array parameters, likely causing a path disclosure in an error message. The NVD entry assigns CVSSv2? vector AV:N/AC:L/Au:N/C:P/I:N/A:N with ba...

CVE-2006-6402

SQL injection vulnerability in mystats.php in MyStats 1.0.8 and earlier allows remote attackers to execute arbitrary SQL commands via the details parameter...

CVE-2006-6401

CVE-2006-6401; XSS in mystats.php of MyStats 1.0.8 and earlier allows remote injection of script/HTML via the parameters (connexion, by, details). Severity ~6.8 (Medium) per NVD; no exploit details provided in the documents. Affected versions: 1.0.8 and earlier; no remediation details are include...

CVE-2006-6401

Multiple cross-site scripting XSS vulnerabilities in mystats.php in MyStats 1.0.8 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 connexion, 2 by, and 3 details parameter...

CVE-2006-6402

CVE-2006-6402 describes a SQL injection in the file mystats.php of MyStats 1.0.8 and earlier via the details parameter. The vulnerability allows remote attackers to execute arbitrary SQL commands . Documents list the affected product and impact but do not provide exploitation steps, affected vers...

CVE-2006-6403: Undefined Security Weakness

mystats.php in MyStats 1.0.8 and earlier allows remote attackers to obtain the installation path via 1 details and 2 by array parameters, probably resulting in a path disclosure in an error message...

CVE-2006-6402: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in mystats.php in MyStats 1.0.8 and earlier allows remote attackers to execute arbitrary SQL commands via the details parameter...

CVE-2006-6401: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in mystats.php in MyStats 1.0.8 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 connexion, 2 by, and 3 details parameter...

MyStats <=1.0.8 [injection sql, multiples xss, array & full path disclosure]

MyStats =1.0.8 injection sql, multiples xss, array & full path disclosure vendor site: http://emcity.nexenservices.com/mystats/index.php product :MyStats 1.0.8 bug: injection sql, multiples xss, array & full path disclosure risk : medium 1/3 Connexion Variable XSS Exploits:...

mystats-108.txt

MyStats alertdocument.cookie&by=jour&ORDERER=datetime mystats/mystats.php?connexion="'/alertdocument.cookie&by=jour&ORDERER=datetime 2/3 Details Variable Injection Sql, Full Path Disclosure, Array GET & XSS Exploits: mystats/mystats.php?details=' mystats/mystats.php?details=...