525 matches found
CVE-2007-0692
DGNews 2.1 allows remote attackers to obtain sensitive information via a fullnews request to news.php with an invalid newsid parameter, and other unspecified vectors, which reveal the path in various error messages...
Design/Logic Flaw
DGNews 2.1 allows remote attackers to obtain sensitive information via a fullnews request to news.php with an invalid newsid parameter, and other unspecified vectors, which reveal the path in various error messages...
CVE-2007-0692
DGNews 2.1 is affected by a path-disclosure vulnerability (CVE-2007-0692) in news.php (fullnews) when an invalid newsid parameter is supplied, potentially revealing server paths via error messages. The issue is triggered by the fullnews/news.php flow and related error output, with the advisory no...
CVE-2007-0692: Undefined Security Weakness
DGNews 2.1 allows remote attackers to obtain sensitive information via a fullnews request to news.php with an invalid newsid parameter, and other unspecified vectors, which reveal the path in various error messages...
CVE-2007-0693: Undefined Security Weakness
SQL injection vulnerability in news.php in DGNews 2.1 allows remote attackers to execute arbitrary SQL commands via the catid parameter in a newslist action. NOTE: this issue can produce resultant cross-site scripting XSS...
DGNews 1.5.1/2.1 - 'news.php' SQL Injection
source: https://www.securityfocus.com/bid/24201/info DGNews is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. Successful exploits could allow an attacker to compromise the application, access or modif...
CVE-2007-2861: Undefined Security Weakness
Multiple PHP remote file inclusion vulnerabilities in Simple Accessible XHTML Online News SAXON 4.6 allow remote attackers to execute arbitrary PHP code via a URL in the template parameter to 1 news.php, 2 preview.php, or 3 archive-display.php...
PT-2007-4165 · Saxon · Saxon
Name of the Vulnerable Software and Affected Versions: SAXON version 4.6 Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the template parameter to specific PHP files, including 1 "news.php", 2 "preview.php", or 3 "archive-display.php". Recommendations: Fo...
Flexphpnews 0.0.5 (news.php newsid) Remote SQL Injection Vulnerability
.-""""""""-. / Dj7xpl | | |, .-. .-. ,| | o/ o | |/ / | @ ^^ |IIIIII|/ @8@8|-IIIIII/-| / / @ +Iranian Are The Best In World+ Portal.......: Flexphpnews version 0.0.5 Download.....: http://www.china-on-site.com/flexphpsite/other.php Author.......: Dj7xpl |...
Flexphpnews 0.0.5 (news.php newsid) Remote SQL Injection Vulnerability
Exploit for unknown platform in category web applications ====================================================================== Flexphpnews 0.0.5 news.php newsid Remote SQL Injection Vulnerability ====================================================================== .-""""""""-. / Dj7xpl \ | | ...
CVE-2007-1550
Multiple SQL injection vulnerabilities in phpx 3.5.15 allow remote attackers to execute arbitrary SQL commands via the 1 imageid or 2 catid parameter to a gallery.php; the 3 newsid parameter to b news.php or c print.php; 4 the newscatid parameter to news.php; the 5 catid, 6 topicid, or 7 postid...
CVE-2007-1550: Undefined Security Weakness
Multiple SQL injection vulnerabilities in phpx 3.5.15 allow remote attackers to execute arbitrary SQL commands via the 1 imageid or 2 catid parameter to a gallery.php; the 3 newsid parameter to b news.php or c print.php; 4 the newscatid parameter to news.php; the 5 catid, 6 topicid, or 7 postid...
PHPX 3.5.153.5.16 - news.php SQL Injection
PHPX 3.5.153.5.16 - news.php SQL Injection source: https://www.securityfocus.com/bid/23033/info PHPX is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input. Exploiting these issues could allow an attacker to steal cookie-based...
built2go-xss.txt
""""""""""""""""""""""""""""""""""""""""""""""" """ :: :: ::::: :::: """ """ :: :: :: : :: """ """ :::: :: :: ::::: ::::: :::: """ """ :: :: ::: ::: :: :: :: :: :: """ """ :: :: :: : : ::::: :: :: :::: """ """ """ """"""""""""""""""""""""""""""""""""""""""""""" Xmor$ DigitaL Hacking TeaM Built2Go...
CVE-2007-1248: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in built2go News Manager Blog 1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 cid, 2 uid, and 3 nid parameters to a news.php, and the nid parameter to b rating.php...
CVE-2007-1142
Cross-site scripting XSS vulnerability in Magic News Plus 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the linkparameters parameter in 1 news.php and 2 nlayouts.php...
Cross site scripting
Cross-site scripting XSS vulnerability in Magic News Plus 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the linkparameters parameter in 1 news.php and 2 nlayouts.php...
CVE-2007-1142
CVE-2007-1142 affects Magic News Plus 1.0.2. The vulnerability is a cross-site scripting (XSS) flaw exploitable via the link_parameters parameter in the files (1) news.php and (2) n_layouts.php, allowing remote attackers to inject arbitrary web script or HTML. The provided sources identify the af...
CVE-2007-1142: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in Magic News Plus 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the linkparameters parameter in 1 news.php and 2 nlayouts.php...
CVE-2007-1019
SQL injection vulnerability in news.php in webSPELL 4.01.02, when registerglobals is enabled, allows remote attackers to execute arbitrary SQL commands via the showonly parameter to index.php, a different vector than CVE-2006-5388...