Photostand_1.2.0 Multiple Cross Site Scripting

Photostand1.2.0 Multiple Cross Site Scripting Vendor site : http://www.photostand.org/ Global risk : medium XSS ----- + Permanents Message & name fields are vulnerable to xss attacks. This kind of xss are pretty dangerous,because anyone who see the page gone get his cookie stolen and sended to th...

enigma-rfi.txt

----------------------------------------------- Enigma Coppermine Bridge boarddir Remote File Include ----------------------------------------------- Author: xoron ----------------------------------------------- Vuln Code: requireonce$boarddir . '/PortalSources/Portal.ini.php';...

softbiz10.txt

Softbiz Banner Exchange Network 1.0 http://softbizscripts.com -------------------------- Cross Site Scripting XSS -------------------------- POST http://target.xx:80/insertmember.php HTTP/1.0 Accept: / Content-Type: application/x-www-form-urlencoded Host: target.xx Content-Length: 152...

softbizDating.txt

Softbiz Dating 1.0 http://www.softbizscripts.com ----------------------------- ------------- SQL injection ------------- http://target.xx/searchresults.php?country=1SQL http://target.xx/searchresults.php?pg=2&sortby=1SQL http://target.xx/featuredphotos.php?browse=1SQL...

CVE-2006-3078

Multiple SQL injection vulnerabilities in APBoard 2.2-r3 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 PHPSESSID parameter in board.php and 2 viewcatmod parameter in main.php...

icewarp.txt

======================= Discovery by:LiNuXrOOt Site:www.alshmokh.com E-mail:[email protected] ======================= Example: /extendlicense/index.html?PHPSESSID=XSS...

Cross site scripting

Cross-site scripting XSS vulnerability in index.html in IceWarp WebMail 5.5.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the PHPSESSID parameter...

CVE-2006-2484

Cross-site scripting XSS vulnerability in index.html in IceWarp WebMail 5.5.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the PHPSESSID parameter...

CVE-2006-2484

Cross-site scripting XSS vulnerability in index.html in IceWarp WebMail 5.5.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the PHPSESSID parameter...

IceWarp Cross-Site Scripting(XSS)

======================= Discovery by:LiNuXrOOt Site:www.alshmokh.com E-mail:[email protected] ======================= Example: /extendlicense/index.html?PHPSESSID=XSS...

CVE-2006-2394

Cross-site scripting XSS vulnerability in chat.php in PHP Live Helper allows remote attackers to inject arbitrary web script or HTML via the PHPSESSID parameter...

Sql injection

SQL injection vulnerability in deleteSession in DBeSession library 1.0.2 and earlier, as used in multiple products, allows remote attackers to execute arbitrary SQL commands via the $sessidset variable, which is usually derived from PHPSESSID...

CVE-2006-0774

SQL injection vulnerability in deleteSession in DBeSession library 1.0.2 and earlier, as used in multiple products, allows remote attackers to execute arbitrary SQL commands via the $sessidset variable, which is usually derived from PHPSESSID...

CVE-2006-0774

SQL injection vulnerability in deleteSession in DBeSession library 1.0.2 and earlier, as used in multiple products, allows remote attackers to execute arbitrary SQL commands via the $sessidset variable, which is usually derived from PHPSESSID...

CVE-2005-4221

CVE-2005-4221 concerns an SQL injection in Arab Portal System 2 Beta 2, specifically in link.php. The vulnerability allows remote attackers to inject arbitrary SQL commands via the PHPSESSID (session ID) or the REQUEST_URI (query string). Public references confirm the issue and its CVE entry, but...

CVE-2005-4221

SQL injection vulnerability in link.php in Arab Portal System 2 Beta 2 allows remote attackers to execute arbitrary SQL commands via the 1 PHPSESSID session ID or 2 REQUESTURI query string...

CVE-2005-3334

CVE-2005-3334 concerns Flyspray, a lightweight bug-tracking web app. The vulnerability affects Flyspray 0.9.7 through 0.9.8 (devel) and is a cross-site scripting (XSS) flaw in the index.php page. An attacker can inject arbitrary web script or HTML via multiple parameters (PHPSESSID, task, string,...

CVE-2004-2512

CRLF injection vulnerability in calendar.php in DCP-Portal 5.3.2 and earlier allows remote attackers to conduct HTTP response splitting attacks to spoof web content and poison web caches via CRLF "%0d%0a" sequences in the PHPSESSID parameter...

CVE-2005-3005

The CVE-2005-3005 issue affects Helpdesk Software Hesk: an authentication bypass via manipulation of the PHPSESSID value (session ID) in admin.php and admin_main.php. Attackers can bypass login remotely by altering the session ID cookie/parameter to gain access without valid credentials; affected...

CubeCart <= 2.0.6 Multiple SQL Injections

The installed version of CubeCart on the remote host suffers from multiple SQL injection vulnerabilities due to its failure to sanitize user input via the 'PHPSESSID' parameter of the 'index.php' script, the 'product' parameter of the 'tellafriend.php' script, the 'add' parameter of the...