CVE-2007-5802

CVE-2007-5802 affects Firewolf Technologies Synergiser 1.2 RC1 and earlier. A directory traversal in index.php allows remote attackers to include and execute arbitrary local files by supplying a .. in the page parameter. This may enable including a local PHP script with a duplicate function decla...

CVE-2002-2420: Improper Input Validation

sitesearcher.cgi in Super Site Searcher allows remote attackers to execute arbitrary commands via shell metacharacters in the page parameter...

CVE-2007-5600: Improper Control of Generation of Code

Incomplete blacklist vulnerability in index.php in Artmedic CMS 3.4 and earlier allows remote attackers to execute arbitrary PHP code via a 1 UNC share pathname, or a 2 ftps, 3 ssh2.sftp, or 4 ssh2.scp URL, in the page parameter, for which PHP remote file inclusion is blocked only for http, https...

CVE-2007-5574: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in djpage.php in PHPDJ 0.5 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter...

Directory traversal

Directory traversal vulnerability in index.php in Artmedic CMS 3.4 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the page parameter...

CVE-2007-5465: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in doop CMS 1.3.7 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the page parameter to an unspecified component...

CVE-2007-5426: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in ActiveKB NX 2.5.4 allow remote attackers to inject arbitrary web script or HTML via the page parameter to the default URI for some directories, as demonstrated by 1 ActiveKB/ and 2 default/categories/ActiveKB/...

CVE-2007-5297

Cross-site scripting XSS vulnerability in index.php in Minki 1.30 allows remote attackers to inject arbitrary web script or HTML via the page parameter...

CVE-2007-5297: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in Minki 1.30 allows remote attackers to inject arbitrary web script or HTML via the page parameter...

CVE-2007-4764

CVE-2007-4764 affects Pawfaliki 0.5.1, where the PHP script pawfaliki.php is vulnerable to a directory-traversal via the page parameter. The root cause is improper handling of relative path components (..), enabling remote attackers to list arbitrary files. The vulnerability is documented in mult...

CVE-2007-4712: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in index.php in eNetman 1 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter...

CVE-2007-4331: Undefined Security Weakness

PHP remote file inclusion vulnerability in index.php in FindNix allows remote attackers to include the contents of arbitrary URLs and conduct cross-site scripting XSS attacks via a URL in the page parameter...

CVE-2007-4071: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in uploader/index.php in Webbler CMS before 3.1.6 allow remote attackers to inject arbitrary web script or HTML via the 1 page or 2 login parameter...

CVE-2007-3831: Undefined Security Weakness

PHP remote file inclusion in main.php in ISS Proventia Network IPS GX5108 1.3 and GX5008 1.5 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter...

CVE-2007-3128

SQL injection vulnerability in content.php in WSPortal 1.0, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the page parameter...

CVE-2007-3127: Undefined Security Weakness

content.php in WSPortal 1.0, when magicquotesgpc is disabled, allows remote attackers to obtain sensitive information via a "';" quote semicolon sequence in the page parameter, which reveals the installation path in the resulting forced SQL error message...

CVE-2007-3128: Undefined Security Weakness

SQL injection vulnerability in content.php in WSPortal 1.0, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the page parameter...

CVE-2007-2470: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in index.php in FileRun 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 page, 2 module, or 3 section parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in htdocs/php.php in OpenConcept Back-End CMS 0.4.7 allows remote attackers to inject arbitrary web script or HTML via the page parameter...

CVE-2007-2099: Undefined Security Weakness

Cross-site scripting XSS vulnerability in htdocs/php.php in OpenConcept Back-End CMS 0.4.7 allows remote attackers to inject arbitrary web script or HTML via the page parameter...