CVE-2008-3379: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Snark VisualPic 0.3.1 allows remote attackers to inject arbitrary web script or HTML via the pic parameter to the default URI. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-0614: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in Photokorn Gallery 1.543 allows remote attackers to execute arbitrary SQL commands via the pic parameter in a showpic action...

Debian Security Advisory DSA 107-1 (jgroff)

The remote host is missing an update to jgroff announced via advisory DSA 107-1. OpenVAS Vulnerability Test $Id: deb1071.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 107-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

orkutfun-xss.txt

Greetings! Doing hard searches and working hard seeking for xss holes we finally found! The new hole is in the description of the pic, you can put html encode chars like this. & l t ; meta http-equiv="refresh" content="0;url=http://suafakeaqui" & g t ; means more or close tag. So you can build...

[Full-disclosure] 0day Orkut XSS [ NEW! ]

Greetings! Doing hard searches and working hard seeking for xss holes we finally found! The new hole is in the description of the pic, you can put html encode chars like this. & l t ; meta http-equiv="refresh" content="0;url=http://suafakeaqui" & g t ; means minus or open tag. means more or close...

CVE-2007-2098: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in showpic.php in Wabbit PHP Gallery 0.9 allow remote attackers to inject arbitrary web script or HTML via the 1 pic and 2 gal parameters...

Coppermine Photo Gallery 1.3.x Remote Blind SQL Injection Exploit

No description provided by source. "; $j = 1; $user = ""; while!strstr$user,chr0 for$x=0;$x255;$x++ $xpl = "'' OR 1=SELECT IFASCIISUBSTRINGusername,".$j.",1=".$x.",1,0 FROM&...

CVE-2007-0265

Multiple cross-site scripting XSS vulnerabilities in Ezboxx Portal System Beta 0.7.6 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the pic parameter to custom/piczoom.asp, 2 the nocatname parameter to boxx/user-upload.asp, or 3 the iid parameter to...

CVE-2007-0265: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Ezboxx Portal System Beta 0.7.6 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the pic parameter to custom/piczoom.asp, 2 the nocatname parameter to boxx/user-upload.asp, or 3 the iid parameter to...

CVE-2006-3888

The CVE-2006-3888 issue affects AOL You’ve Got Pictures (YGP) Pic Downloader ActiveX control (AOL.PicDownloadCtrl.1, YGPPicDownload.dll) used in AOL 9.0 Security Edition. A buffer overflow allows remote attackers to execute arbitrary code via a long argument to SetAlbumName. The vulnerability is ...

CVE-2006-3138

Multiple cross-site scripting XSS vulnerabilities in phpMyDirectory 10.4.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 PIC parameter in offers-pix.php, 2 from parameter in cp/index.php, and 3 action parameter in cp/adminindex.php...

CVE-2006-2728: Undefined Security Weakness

Cross-site scripting XSS vulnerability in superalbum/index.php in Photoalbum B&W 1.3 allows remote attackers to inject arbitrary web script or HTML via the pic parameter...

Sql injection

Multiple SQL injection vulnerabilities in EImagePro allow remote attackers to execute arbitrary SQL commands via the 1 CatID parameter to subList.asp, 2 SubjectID parameter to imageList.asp, or 3 Pic parameter to view.asp...

CVE-2006-2300

Multiple SQL injection vulnerabilities in EImagePro allow remote attackers to execute arbitrary SQL commands via the 1 CatID parameter to subList.asp, 2 SubjectID parameter to imageList.asp, or 3 Pic parameter to view.asp...

CVE-2006-2300: Undefined Security Weakness

Multiple SQL injection vulnerabilities in EImagePro allow remote attackers to execute arbitrary SQL commands via the 1 CatID parameter to subList.asp, 2 SubjectID parameter to imageList.asp, or 3 Pic parameter to view.asp...

CVE-2006-1750: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in index.php in Autogallery 0.41 allow remote attackers to inject arbitrary web script or HTML via the 1 pic or 2 show parameters...

CVE-2003-1239

Directory traversal vulnerability in sendphoto.php in WihPhoto 0.86 allows remote attackers to read arbitrary files via .. specifiers in the album parameter, and the target filename in the pic parameter...

CVE-2005-3022

Multiple SQL injection vulnerabilities in vBulletin 3.0.9 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 announcement parameter to announcement.php, 2 userid parameter to user.php, 3 calendar parameter to admincalendar.php, 4 cronid parameter to cronlog.php, 5...

CVE-2002-1724

Cross-site scripting vulnerability XSS in phpimageview.php for PHPImageView 1.0 allows remote attackers to execute arbitrary script as other users via the pic parameter...

CVE-2002-1724: Undefined Security Weakness

Cross-site scripting vulnerability XSS in phpimageview.php for PHPImageView 1.0 allows remote attackers to execute arbitrary script as other users via the pic parameter...