CVE-2007-3592

Vulnerability CVE-2007-3592 affects Elite Bulletin Board (earlier than 1.0.10). The PM.php module allows remote authenticated users to delete arbitrary private messages and other attacks by modifying id fields, indicating improper input validation of message identifiers. The issue enables manipul...

CVE-2007-3592: Undefined Security Weakness

PM.php in Elite Bulletin Board before 1.0.10 allows remote authenticated users to delete arbitrary PM messages and conduct other attacks via modified id fields...

MyEvent1.6 (template.php) Remote File Inclusion Vulnerability

.-" "-. / | TiTaNiC | |, .-. .-. ,| | o/ o | |/ / | @ ^^ |IIIIII|/ @8@8|-IIIIII/-| / HaCkEr / @ script:PBSite - PHP Bulletin Site | CMS ==== RFI url:http://sourceforge.net/project/showfiles.php?groupid=88114 authot:titanichacker [email protected] contact: hack-teach.com & mohandko.com...

PBSite - PHP Bulletin Site | CMS ====> RFI

.-" "-. / | TiTaNiC | |, .-. .-. ,| | o/ o | |/ / | @ ^^ |IIIIII|/ @8@8|-IIIIII/-| / HaCkEr / @ script:PBSite - PHP Bulletin Site | CMS ==== RFI url:http://sourceforge.net/project/showfiles.php?groupid=88114 authot:titanichacker [email protected] contact: hack-teach.com & mohandko.com...

CVE-2007-2339

Multiple SQL injection vulnerabilities in Phorum before 5.1.22 allow remote attackers to execute arbitrary SQL commands via 1 a modified recipients parameter name in a pm.php; 2 the curr parameter to the b badwords aka censorlist or c banlist module in admin.php; or 3 the "Edit groups / Add group...

CVE-2007-2339: Undefined Security Weakness

Multiple SQL injection vulnerabilities in Phorum before 5.1.22 allow remote attackers to execute arbitrary SQL commands via 1 a modified recipients parameter name in a pm.php; 2 the curr parameter to the b badwords aka censorlist or c banlist module in admin.php; or 3 the "Edit groups / Add group...

[waraxe-2007-SA#049] - Multiple vulnerabilities in Phorum 5.1.20

waraxe-2007-SA049 - Multiple vulnerabilities in Phorum 5.1.20 ==================================================================== Author: Janek Vind "waraxe" Date: 19. April 2007 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-49.html Target software description: Phorum 5.1.20...

Discuz! pm.php注入EXP

No description provided by source. htmlbr / headbr / meta http-equiv="Content-Type" content="text/html; charset=gb2312"br / titleDz 0day by Jackal/titlebr / SCRIPT LANGUAGE="JavaScript"br / !--br / function ReplaceDemotempbr / var r, re;br / re = /S+s+S+/g;br /...

CVE-2006-4881

Multiple cross-site scripting XSS vulnerabilities in David Bennett PHP-Post PHPp 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the replyuser parameter in a pm.php; 2 the txtjumpto parameter in b dropdown.php; the 3 txterror and 4 txttemplatenotexist parameter...

CVE-2006-4881: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in David Bennett PHP-Post PHPp 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the replyuser parameter in a pm.php; 2 the txtjumpto parameter in b dropdown.php; the 3 txterror and 4 txttemplatenotexist parameter...

CVE-2006-4078

pm.php aka the PM system in DeluxeBB 1.08, and possibly earlier, allows remote attackers to bypass authentication by providing an arbitrary username in the membercookie cookie parameter...

CVE-2006-4078

pm.php aka the PM system in DeluxeBB 1.08, and possibly earlier, allows remote attackers to bypass authentication by providing an arbitrary username in the membercookie cookie parameter...

CVE-2006-4078

The CVE-2006-4078 entry concerns DeluxeBB 1.08 (and possibly earlier) where pm.php (the PM system) allows remote attackers to bypass authentication by supplying an arbitrary username in the membercookie cookie parameter. This is a logic/authorization flaw in the PM component that enables access w...

CVE-2006-4078: Undefined Security Weakness

pm.php aka the PM system in DeluxeBB 1.08, and possibly earlier, allows remote attackers to bypass authentication by providing an arbitrary username in the membercookie cookie parameter...

CVE-2006-3691: Undefined Security Weakness

Multiple SQL injection vulnerabilities in VBZooM 1.11 and earlier allow remote attackers to execute arbitrary SQL commands via the UserID parameter to 1 ignore-pm.php, 2 sendmail.php, 3 reply.php or 4 sub-join.php...

CVE-2006-3611: Undefined Security Weakness

Directory traversal vulnerability in pm.php in Phorum 5 allows remote authenticated users to include and execute arbitrary local files via directory traversal sequences in the GLOBALStemplate parameter, as demonstrated by injecting PHP sequences into a log file, which is then included by pm.php...

Phorum 5 (pm.php) Arbitrary Local Inclusion Exploit

No description provided by source. !/usr/bin/php -q -d shortopentag=on ? echo "PHORUM 5 arbitrary local inclusion exploit\n"; echo "by rgod [email protected]\n"; echo "site: http://retrogod.altervista.org\n"; echo "dork: "This forum powered by Phorum."\n\n"; / works with: registerglobals=On...

CVE-2006-3303

DeluxeBB 1.07 and earlier have cross-site scripting in pm.php, exploitable via the subject or to parameters, enabling injection of arbitrary script/HTML. Root cause: improper input handling in pm.php leading to reflected XSS. Impact per available data is partial integrity impact with no confident...

CVE-2006-3303: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in pm.php in DeluxeBB 1.07 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 subject or 2 to parameters...

CVE-2005-2465: Undefined Security Weakness

Cross-site scripting XSS vulnerability in pm.php in PCXP/TOPPE CMS allows remote attackers to inject arbitrary web script or HTML via the msg variable...