3841 matches found
CVE-2010-2269
Directory traversal vulnerability in loadstatic.cgi in Accoria Web Server aka Rock Web Server 1.4.7 allows remote attackers to read arbitrary files via a .. dot dot in the name parameter...
Cross site scripting
Cross-site scripting XSS vulnerability in subitems.php in PHP Easy Shopping Cart 3.1R allows remote attackers to inject arbitrary web script or HTML via the name parameter...
CVE-2009-4856: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in subitems.php in PHP Easy Shopping Cart 3.1R allows remote attackers to inject arbitrary web script or HTML via the name parameter...
CVE-2010-1712: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in base/Comments.php in Webmobo WB News 2.3.3 allow remote attackers to inject arbitrary web script or HTML via the 1 name and possibly 2 message parameters. NOTE: some of these details are obtained from third party information...
Sql injection
SQL injection vulnerability in profile.php in WebLeague 2.2.0 allows remote attackers to execute arbitrary SQL commands via the name parameter...
CVE-2009-4560: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in profile.php in WebLeague 2.2.0 allows remote attackers to execute arbitrary SQL commands via the name parameter...
CVE-2009-3469: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in profiles/html/simpleSearch.do in IBM Lotus Connections 2.0.1 allows remote attackers to inject arbitrary web script or HTML via the name parameter...
Authentication flaw
admin.php in Arz Development The Gemini Portal 4.7 and earlier allows remote attackers to bypass authentication and gain administrator privileges by setting the user cookie to "admin" and setting the name parameter to "users."...
CVE-2008-6851: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in page.php in PHP Link Directory phpLD 3.3, when registerglobals is enabled and magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the name parameter...
PT-2009-4565 · Fretsweb · Fretsweb
Name of the Vulnerable Software and Affected Versions: FretsWeb version 1.2 Description: The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the name parameter to "player.php" and the hash parameter to "song.php". Recommendations: For FretsWeb version 1.2...
PT-2009-4529 · Drupal · Drupal Views
Name of the Vulnerable Software and Affected Versions: Drupal Views module versions prior to 6.x-2.6 Description: A cross-site scripting XSS issue allows remote authenticated users to inject arbitrary web script or HTML via exposed filters in the Views UI administrative interface and the view nam...
CVE-2009-1525
CMDDB in JBMC Software DirectAdmin before 1.334 allows remote authenticated users to gain privileges via shell metacharacters in the name parameter during a restore action...
CVE-2008-6629
Cross-site scripting XSS vulnerability in detail.php in WEBBDOMAIN Multi Languages WebShop Online 1.02 allows remote attackers to inject arbitrary web script or HTML via the name parameter...
CVE-2008-6629: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in detail.php in WEBBDOMAIN Multi Languages WebShop Online 1.02 allows remote attackers to inject arbitrary web script or HTML via the name parameter...
CVE-2009-1228
Cross-site scripting XSS vulnerability in register.php in Arcadwy Arcade Script CMS allows remote attackers to inject arbitrary web script or HTML via the username field username parameter...
Jinzora Media Jukebox 2.8 - 'name' Local File Inclusion
:::::::-. ... ::::::. :::. ;;, ';, ;; ;;;;;;;, ;;; ' . ' $$, $$$$ $$$ $$$ "Y$c$$ 888,o8P'88 .d888 888 Y88 MMMMP" "YmmMMMM"" MMM YM Discovered by dun \ dunatstrcpy.pl Jinzora Media Jukebox = 2.8 Local File Inclusion Vulnerability Script site: http://jinzora.com/ ,...
Cross site scripting
Cross-site scripting XSS vulnerability in ScriptsEz Ez PHP Comment allows remote attackers to inject arbitrary web script or HTML via the name parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...
CVE-2009-0818: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the taxonomythemeadmintablebuilder function taxonomythemeadmin.inc in Taxonomy Theme module before 5.x-1.2, a module for Drupal, allows remote authenticated users with the "administer taxonomy" permission, or the ability to create pages when tagging is...
CVE-2009-0762: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in ScriptsEz Ez PHP Comment allows remote attackers to inject arbitrary web script or HTML via the name parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...