Cross site scripting

Cross-site scripting XSS vulnerability in index.php in Arizona Dream Livre d'or livor 2.5 allows remote attackers to inject arbitrary web script or HTML via the page parameter...

CVE-2007-1919: Undefined Security Weakness

Cross-site scripting XSS vulnerability in index.php in Arizona Dream Livre d'or livor 2.5 allows remote attackers to inject arbitrary web script or HTML via the page parameter...

CVE-2006-7012

scart.cgi in SCart 2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the page parameter of a showtext action...

CVE-2006-7012: Undefined Security Weakness

scart.cgi in SCart 2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the page parameter of a showtext action...

Directory traversal

Directory traversal vulnerability in index.php in Guernion Sylvain Portail Web Php aka Gsylvain35 Portail Web, PwP allows remote attackers to read arbitrary files via a .. dot dot in the page parameter. NOTE: this issue was later reported for 2.5.1.1...

CVE-2006-6951

CVE-2006-6951 describes a cross-site scripting (XSS) flaw in OdysseusBlog’s blog.php, exploitable by supplying a crafted value for the page parameter. Remote attackers could inject arbitrary script/HTML when the affected page is viewed, as reported in the connected documents. The sources confirm ...

CVE-2006-6951: Undefined Security Weakness

Cross-site scripting XSS vulnerability in blog.php in OdysseusBlog allows remote attackers to inject arbitrary web script or HTML via the page parameter...

CVE-2006-6211: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in BirdBlog 1.4.0 allow remote attackers to inject arbitrary web script or HTML via the 1 msg parameter to a admin/admincore.php, the 2 month parameter to b admin/comments.php or c admin/entries.php, or the 3 page parameter to d admin/logs.php,...

CVE-2006-6212: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in centre.php in Site News sitenews 2.00, and possibly earlier, allows remote attackers to execute arbitrary PHP code via a URL in the page parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party...

CVE-2006-6151: Undefined Security Weakness

PHP remote file inclusion vulnerability in centre.php in Messagerie Locale as of 20061127 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2006-6118: Undefined Security Weakness

Cross-site scripting XSS vulnerability in thumbs.php in mmgallery 1.55 allows remote attackers to inject arbitrary web script or HTML via the page parameter...

CVE-2006-5651: Undefined Security Weakness

list.php in DigiOz Guestbook before 1.7.1 allows remote attackers to obtain sensitive information via a non-numeric page parameter, which displays the installation path in the resulting error message...

CVE-2006-5590: Undefined Security Weakness

PHP remote file inclusion vulnerability in index.php in ArticleBeach Script 2.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the page parameter...

CVE-2006-5594: Undefined Security Weakness

PHP remote file inclusion vulnerability in University of British Columbia iPeer 2.0, and possibly earlier, allows remote attackers to execute arbitrary PHP code via a URL in the page parameter. NOTE: it is possible that this issue is related to CakePHP...

CVE-2006-5493: Undefined Security Weakness

PHP remote file inclusion vulnerability in template/purpletech/baseinclude.php in DigitalHive 2.0 RC2 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter...

CVE-2006-5315: Undefined Security Weakness

PHP remote file inclusion vulnerability in main.php in registroTL allows remote attackers to execute arbitrary PHP code via an ftp:// URL in the page parameter...

CVE-2006-5190: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in osCommerce 2.2 Milestone 2 Update 060817 allow remote attackers to inject arbitrary web script or HTML via the 1 page parameter in the a bannermanager.php, b bannerstatistics.php, c countries.php, d currencies.php, e languages.php, f...

CVE-2006-5093: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in index.php in Tagmin Control Center in TagIt! Tagboard 2.1.B Build 2 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter...

CVE-2006-5029: Undefined Security Weakness

SQL injection vulnerability in thread.php in WoltLab Burning Board wBB 2.3.x allows remote attackers to obtain the version numbers of PHP, MySQL, and wBB via the page parameter. NOTE: this issue might be a forced SQL error. Also, the original report was disputed by a third party for 2.3.3 and 2.3...

EV0134.txt

New eVuln Advisory: Doika guestbook 'page' XSS Vulnerability http://evuln.com/vulns/134/summary.html --------------------Summary---------------- eVuln ID: EV0134 CVE: CVE-2006-4325 Software: Doika guestbook Sowtware's Web Site: http://doika.net/ Versions: 2.5 Critical Level: Harmless Type:...