CVE-2005-2163

Cross-site scripting XSS vulnerability in index.php in AutoIndex PHP Script 1.5.2 allows remote attackers to inject arbitrary web script or HTML via the search parameter...

CVE-2005-2163: Undefined Security Weakness

Cross-site scripting XSS vulnerability in index.php in AutoIndex PHP Script 1.5.2 allows remote attackers to inject arbitrary web script or HTML via the search parameter...

Geeklog User Comment Retrieval SQL Injection

The installed version of Geeklog suffers from a SQL injection vulnerability due to the application's failure to sanitize user- supplied input via the 'order' parameter of the 'comment.php' script. By leveraging this flaw, an attacker may be able to recover sensitive information, such as password...

AutoIndex PHP Script 1.5.2 - index.php Cross-Site Scripting

AutoIndex PHP Script 1.5.2 - index.php Cross-Site Scripting source: https://www.securityfocus.com/bid/14154/info AutoIndex PHP Script is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may...

AutoIndex PHP Script 1.5.2 - 'index.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/14154/info AutoIndex PHP Script is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code executed in the...

GLSA-200507-02 : WordPress: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200507-02 WordPress: Multiple vulnerabilities James Bercegay of the GulfTech Security Research Team discovered that WordPress insufficiently checks data passed to the XML-RPC server. He also discovered that WordPress has several...

GLSA-200507-01 : PEAR XML-RPC, phpxmlrpc: PHP script injection vulnerability

The remote host is affected by the vulnerability described in GLSA-200507-01 PEAR XML-RPC, phpxmlrpc: PHP script injection vulnerability James Bercegay of GulfTech Security Research discovered that the PEAR XML-RPC and phpxmlrpc libraries fail to sanatize input sent using the 'POST' method. Impac...

WordPress: Multiple vulnerabilities

Background WordPress is a PHP and MySQL based content management and publishing system. Description James Bercegay of the GulfTech Security Research Team discovered that WordPress insufficiently checks data passed to the XML-RPC server. He also discovered that WordPress has several cross-site...

WebCalendar assistant_edit.php Unauthorized Access

The remote version of WebCalendar fails to restrict access to the script 'assistantedit.php'. An attacker can use this script to change assistants and to display all users in the system even when the 'Public access can view other users' setting has been disabled. %NASLMINLEVEL 70300 C Tenable...

Simple Machines Forum msg Parameter SQL Injection Vulnerability

The remote host is running Simple Machines Forum SMF, an open source web forum application written in PHP. The installed version of SMF on the remote host fails to properly sanitize input to the 'msg' parameter before using it in SQL queries. By exploiting this flaw, an attacker can affect databa...

Siteframe siteframe.php LOCAL_PATH Parameter Remote File Inclusion

The remote host is running Siteframe, an open source content management system using PHP and MySQL. The installed version of Siteframe does not properly sanitize the 'LOCALPATH' parameter of the 'siteframe.php' script before using it to include files. By leveraging this flaw, an attacker is able ...

[EXPL] ZeroBoard Remote Command Execution (Exploit, preg_replace)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...

ZeroBoard 4.1 - 'preg_replace' Remote Nobody Shell

/ ---------------------------------------------------------------------------------- + Zeroboard pregreplace vulnerability Remote nobody shell exploit ---------------------------------------------------------------------------------- by n0gada [email protected] date : 2005/5/29 the bug Origina...

Horde Nag common-footer.inc Parent Frame Page Title XSS

According to its version, the remote installation of Nag fails to fully sanitize user-supplied input when setting the parent frame's page title by JavaScript in 'templates/common-footer.inc'. By leveraging this flaw, an attacker may be able to inject arbitrary HTML and script code into a user's...

Netref 4.2 - Cat_for_gen.php Remote PHP Script Injection

Netref 4.2 - Catforgen.php Remote PHP Script Injection source: https://www.securityfocus.com/bid/13275/info A remote PHP script injection vulnerability affects Netref. This issue is due to a failure of the application to sanitize user-supplied data. An attacker may leverage this issue to execute...

Netref 4.2 - 'Cat_for_gen.php' Remote PHP Script Injection

source: https://www.securityfocus.com/bid/13275/info A remote PHP script injection vulnerability affects Netref. This issue is due to a failure of the application to sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary PHP script code in the context of an affected...

Invision Power Board index.php Members Action st Parameter SQL Injection

A version of Invision Power Board installed on the remote host suffers from a SQL injection vulnerability due to its failure to sanitize user input via the 'st' parameter to the 'index.php' script. An attacker can take advantage of this flaw to inject arbitrary SQL statements into Invision Power...

CVE-2005-0478

Multiple buffer overflows in TrackerCam 5.12 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via 1 an HTTP request with a long User-Agent header or 2 a long argument to an arbitrary PHP script...

MagicScripts E-Store Kit-2 PayPal Edition - Remote File Inclusion

MagicScripts E-Store Kit-2 PayPal Edition - Remote File Inclusion source: https://www.securityfocus.com/bid/12910/info MagicScripts E-Store Kit-2 PayPal Edition is prone to a remote file include vulnerability. Remote attackers could potentially exploit this issue to include a remote malicious PHP...

MagicScripts E-Store Kit-2 PayPal Edition - Remote File Inclusion

source: https://www.securityfocus.com/bid/12910/info MagicScripts E-Store Kit-2 PayPal Edition is prone to a remote file include vulnerability. Remote attackers could potentially exploit this issue to include a remote malicious PHP script. If the attacker is able to execute the remote script it...