Directory traversal

Directory traversal vulnerability in index.php in Guernion Sylvain Portail Web Php aka Gsylvain35 Portail Web, PwP allows remote attackers to read arbitrary files via a .. dot dot in the page parameter. NOTE: this issue was later reported for 2.5.1.1...

CVE-2006-6951

CVE-2006-6951 describes a cross-site scripting (XSS) flaw in OdysseusBlog’s blog.php, exploitable by supplying a crafted value for the page parameter. Remote attackers could inject arbitrary script/HTML when the affected page is viewed, as reported in the connected documents. The sources confirm ...

EV0134.txt

New eVuln Advisory: Doika guestbook 'page' XSS Vulnerability http://evuln.com/vulns/134/summary.html --------------------Summary---------------- eVuln ID: EV0134 CVE: CVE-2006-4325 Software: Doika guestbook Sowtware's Web Site: http://doika.net/ Versions: 2.5 Critical Level: Harmless Type:...

CVE-2006-4610

PHP remote file inclusion vulnerability in index.php in GrapAgenda 0.11 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via the page parameter...

CVE-2006-4325

Cross-site scripting XSS vulnerability in gbook.php in Doika guestbook 2.5, and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via the page parameter...

CVE-2006-4224

Cross-site scripting XSS vulnerability in calendar.php in Virtual War VWar 1.5.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the year parameter. NOTE: The page parameter vector is covered by CVE-2006-4009...

CVE-2006-4009

Cross-site scripting XSS vulnerability in war.php in Virtual War Vwar 1.5.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the page parameter...

CVE-2006-3777

PHP remote file inclusion vulnerability in index.php in IDevSpot PhpLinkExchange 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter...

CVE-2006-3249

CVE-2006-3249 describes a SQL injection in Phorum 5.1.14 and earlier via the search.php page parameter. Affected component: Phorum’s search function; root cause: improper handling of the page parameter, enabling arbitrary SQL execution. Impact: remote attackers could run arbitrary SQL commands. V...

PT-2006-4143 · Phorum · Phorum

Name of the Vulnerable Software and Affected Versions: Phorum versions 5.1.14 and earlier Description: A SQL injection issue in the search.php file allows remote attackers to potentially execute arbitrary SQL commands via the page parameter. However, the vendor disputes this report, stating that...

CVE-2006-3150

SQL injection vulnerability in index.php in CavoxCms 1.0.16 and earlier allows remote attackers to execute arbitrary SQL commands via the page parameter...

CVE-2006-3001

Cross-site scripting XSS vulnerability in search.php in OkScripts OkMall 1.0 allow remote attackers to inject arbitrary web script or HTML via the page parameter. NOTE: this might be resultant from another vulnerability, since the XSS is reflected in an error message...

PT-2006-3783 · Phpbb · Phpbb 2

Name of the Vulnerable Software and Affected Versions: phpBB 2 Description: A remote file inclusion issue in phpBB 2 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter of the template.php file. However, the existence of this issue has been disputed, with some...

CVE-2006-2810

Multiple cross-site scripting XSS vulnerabilities in Belchior Foundry vCard 2.9 allow remote attackers to inject arbitrary web script or HTML via the page parameter in 1 toprated.php and 2 newcards.php. NOTE: the cardid vector is already covered by CVE-2006-1230...

Cross site scripting

Cross-site scripting XSS vulnerability in gallery.php in Captivate 1.0 allows remote attackers to inject arbitrary web script or HTML via the page parameter, which is reflected in an error message...

CVE-2006-2368

Cross-site scripting XSS vulnerability in index.php in Clansys aka Clanpage System 1.1 allows remote attackers to inject arbitrary web script or HTML via the page parameter...

CVE-2006-2368

Cross-site scripting XSS vulnerability in index.php in Clansys aka Clanpage System 1.1 allows remote attackers to inject arbitrary web script or HTML via the page parameter...

CVE-2006-2208

Multiple cross-site scripting XSS vulnerabilities in mynews.inc.php in MyNews 1.6.2 allow remote attackers to inject arbitrary web script or HTML via the 1 hash and 2 page parameters...

CVE-2006-2208

Multiple cross-site scripting XSS vulnerabilities in mynews.inc.php in MyNews 1.6.2 allow remote attackers to inject arbitrary web script or HTML via the 1 hash and 2 page parameters...

PT-2006-3182 · Mynews · Mynews

Name of the Vulnerable Software and Affected Versions: MyNews version 1.6.2 Description: The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the hash and page parameters. Recommendations: For...