CVE-2008-0464

Directory traversal vulnerability in archiv.cgi in absofort aconon Mail 2007 Enterprise SQL 11.7.0 and Mail 2004 Enterprise SQL 11.5.1 allows remote attackers to read arbitrary files via a .. dot dot in the template parameter...

AdultScript 'id' SQL注入漏洞

AdultScript是一款基于PHP的WEB应用程序。 AdultScript不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击，可获得敏感信息或操作数据库。 问题是由于多个脚本对用户提交的WEB参数处理缺少充分过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。 AdultScript AdultScript 1.6.5 AdultScript AdultScript 1.6 目前没有解决方案提供： http://www.adultscript.net/...

PT-2007-4088

Name of the Vulnerable Software and Affected Versions SunLight CMS version 5.3 Description The issue allows remote attackers to execute arbitrary PHP code. This can be achieved by providing a URL in the root parameter to specific PHP files, such as connect.php or modules/startup.php...

CVE-2007-2157

CVE-2007-2157 describes a directory traversal vulnerability in the Zomplog 3.8 application, specifically in upload/force_download.php. An attacker can use a dot-dot (..) sequence in the file parameter to read arbitrary files. The NVD entry confirms the issue and lists a high impact potential for ...

CVE-2006-6150

PHP remote file inclusion vulnerability in memory/OWLMemoryProperty.php in OWLLib 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the OWLLIBROOT parameter...

CVE-2006-5413

Multiple PHP remote file inclusion vulnerabilities in SuperMod 3.0.0 for YABB YaBBSM allow remote attackers to execute arbitrary PHP code via a URL in the sourcedir parameter to 1 Offline.php, 2 Sources/Admin.php, 3 Sources/Offline.php, or 4 content/portalshow.php...

CVE-2006-5196

The HTTP interface in the Motorola SURFboard SB4200 Cable Modem allows remote attackers to cause a denial of service device crash via a request with MfcISAPICommand set to SecretProc and a long string in the Secret parameter...

CVE-2006-4631

Direct static code injection vulnerability in admin/saveopt.php in SoftBB 0.1, and possibly earlier, allows remote authenticated users to upload and execute arbitrary PHP code via the cacheforum parameter, which saves the code to infooptions.php, which is accessible via a direct request...

CVE-2006-4060

PHP remote file inclusion vulnerability in calendar.php in Visual Events Calendar 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the cfgdir parameter...

CVE-2006-2674

Multiple SQL injection vulnerabilities in Tamber Forum 1.9.13 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 frmid parameter to a showforum.asp, 2 a search field to b forumsearch.asp, 3 Email address or 4 Password to c admin/index.asp, 5 frmcatid parameter to d...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in admin/serverdaystats.php in Virtual Hosting Control System VHCS allow remote attackers to inject arbitrary web script or HTML via the 1 day, 2 month, or 3 year parameter...

CVE-2006-1972

Cross-site scripting XSS vulnerability in EasyGallery.php in Wingnut EasyGallery allows remote attackers to inject arbitrary web script or HTML via the ordner parameter...

CVE-2006-1760

Multiple cross-site scripting XSS vulnerabilities in JetPhoto allow remote attackers to inject arbitrary web script or HTML via the page parameter in 1 Classic.view/thumbnail.php, 2 Classic.view/gallery.php, 3 Classic.view/detail.php, or 4 Orange.view/detail.php; or 5 the name parameter in...

[SA18472] Widexl Download Tracker "ID" Parameter Cross-Site Scripting

TITLE: Widexl Download Tracker "ID" Parameter Cross-Site Scripting SECUNIA ADVISORY ID: SA18472 VERIFY ADVISORY: http://secunia.com/advisories/18472/ CRITICAL: Less critical IMPACT: Cross Site Scripting WHERE: From remote SOFTWARE: Widexl Download Tracker 1.x http://secunia.com/product/6830/...

CVE-2005-4387

Cross-site scripting XSS vulnerability in home.php in contenite 0.11 and earlier allows remote attackers to inject arbitrary web script or HTML via the id parameter...

SQL-injections in koobi-cms

SQL-injections in koobi-cms 4.2.3 The program: koobi-cms Homepage: http://www.dream4.de/ Vulnerable Versions: 4.2.3 Has found: CENSORED SVT 28.04.05 The description --------------- Vulnerability has been found in parameter page. In koobi-cms it Refers to - p. Data transferred to this parameter no...

PerlDesk < 2 kb.cgi view Parameter SQL Injection

Binary data 2597.prm...

CVE-2004-2347

blog.cgi in Leif M. Wright Web Blog 1.1 and 1.1.5 allows remote attackers to execute arbitrary commands via shell metacharacters such as '|' in the file parameter of ViewFile requests...

Alan Ward A-Cart 2.0 - MSG Cross-Site Scripting

Alan Ward A-Cart 2.0 - MSG Cross-Site Scripting source: https://www.securityfocus.com/bid/8722/info A-Cart has been reported prone to a cross-site scripting vulnerability. The issue presents itself likely due to a lack of sufficient sanitization performed on data contained in the 'msg' URI...

Invision Power Board (IP.Board) 1.x - index.php showtopic Cross-Site Scripting

Invision Power Board IP.Board 1.x - index.php showtopic Cross-Site Scripting source: https://www.securityfocus.com/bid/8575/info Invision Power Board is prone to a cross-site scripting vulnerability. It has been reported that a remote attacker may construct a malicious link to the index.php scrip...