buddyzone101.txt

Buddy Zone Version 1.0.1 Homepage: http://www.vastal.com/buddy-zone-social-networking-script.html Affected files: Sending invitations Profiles Blogs Journals Posting comments Posting in the forum Sending mail Creating a group viewsubforum.php viewpost.php viewclassifieds.php viewad.php...

v3chatIM.txt

V3 Chat Instant Messenger http://www.v3chat.com/ Affected files: /mail/index.php /mail/reply.php isonline.php online.php profile.php profileview.php search.php mycontacts.php expire.php Editing your profile: - input boxes ------------------------------------------ Mail Vulnerabilities: Full path...

singaporeMultiple.txt

Produce : singapore gallery Versions : 0.10.0 and prior Site : http://www.sgal.org/ Discovred By : Moroccan Security Research Team Simo64 Greetz : CiM-Team - dabdoub - DarkbiteX - drackanz - Iss4m - Mourad - Rachid .:r00tkita - s4mi - Silitix - tahati - And All Friends : - Vulnerable code near...

CVE-2006-3167

Free Realty before 2.9 allows remote attackers to obtain the full path and other sensitive information via unspecified manipulations that produce an error message...

MPCS v0.2 - XSS

MPCS v0.2 Homepage: http://tpvgames.co.uk/mpcs Affected files: comment.php XSS vuln with cookie & full path disclosure: Direct html injection doesnt seem to work, however, if you navigate to the code below in your browser, and then post a comment on the same page, our XSS example will occure...

singapore gallery <= 0.10.0 Multiple Vulnerabilities

Produce : singapore gallery Versions : 0.10.0 and prior Site : http://www.sgal.org/ Discovred By : Moroccan Security Research Team Simo64 Greetz : CiM-Team - dabdoub - DarkbiteX - drackanz - Iss4m - Mourad - Rachid .:r00tkita - s4mi - Silitix - tahati - And All Friends : - Vulnerable code near...

CVE-2006-3091

CVE-2006-3091 affects PhpMyFactures 1.0 (and possibly 1.2 and earlier). The issue allows remote attackers to obtain the installation path by making direct requests to (1) /verif.php, (2) /inc/footer.php, and (3) /remises/ajouter_remise.php. The NVD entry lists a CVSS2 base score of 5.0 (Medium) w...

PhpMyFactures 1.0 Cross Site Scripting, SQL Injection, Full Path Disclosure and others

PhpMyFactures 1.0 Full Path Disclosure Guest http://.../verif.php Guest http://.../inc/footer.php Guest http://.../remises/ajouterremise.php Informations modification Guest http://.../tva/ajoutertva.php?action=send&tva=DIGITS Guest...

CVE-2006-3003

details.php in Easy Ad-Manager allows remote attackers to obtain the full installation path via an invalid mbid parameter, which leaks the path in an error message. NOTE: this might be resultant from another vulnerability, since this vector also produces cross-site scripting XSS. NOTE: on 2006082...

CVE-2006-3003

CVE-2006-3003 affects Easy Ad-Manager: details.php accepts an invalid mbid parameter which can reveal the full installation path in an error message. The issue may tie to a related XSS vector. The vendor was notified on 2006-08-29 that the issue was fixed. The public details specify the vulnerabi...

CVE-2006-2978

CVE-2006-2978 affects Mafia Moblog 0.6M1 and earlier. The issue allows remote attackers to disclose the installation path via an error message triggered by direct requests to (1) big.php and (2) upgrade.php. No additional exploit details or impact beyond path disclosure are provided in the docume...

mafiamoblog.txt

Produce : Mafia Moblog WebSite :http://mafia.pearlabs.org Version : 6 Full and Prior Discovred By :Moroccan Security Research Team Simo64 IMPACT : Manipulation of data, System access + Full Path Disclosure : The problem is that it is possible to disclose the full path to 'big.php','upgrade.php' b...

mole.com.ua Booking Script

Booking Script. Homepage: http://www.mole.com.ua PError with full path disclosure and possible buffer overflow?: http://www.example.com/week.php?year=2006&month=06&day=0' Warning: checkdate expects parameter 2 to be long, string given in...

TinyMuw v1.0 - XSS

TinyMuw v1.0 Homepage: http://www.l0j1k.com/tinyMuw/index.php Effected files: quickchat.php input box videoPage.php Input isn't sanatized before being generated in the quickchat.php chatbox. For PoC try putting: IMG SRC=javascript:alert'XSS' in as your comment. Full path disclosure error via URL...

E-Dating System from scriptsez.net - XSS

E-Dating System Homepage: http://www.scriptsez.net/ Effected files: Input boxes. cindex.php Description: A Professional dating system that uses flatfiles instead of MySQL. XSS Vulnerabilities PoC: The input boxes of sending a message, and editing your profile do not properally filter user input...

Easy Ad-Manager

Easy Ad-Manager v. unknown, not listed on homepage Homepage: http://www.scriptsez.net Effected files: details.php XSS Vulnerability with full path disclosure: http://www.example.com/eam/details.php?do=load&mbid=/SCRIPT20SRC=http://evilsite.com/xss.js/SCRIPT Warning: fopenstats//This is remote tex...

Mafia Moblog Full Path Disclosure / SQL injection

Produce : Mafia Moblog WebSite :http://mafia.pearlabs.org Version : 6 Full and Prior Discovred By :Moroccan Security Research Team Simo64 IMPACT : Manipulation of data, System access + Full Path Disclosure : The problem is that it is possible to disclose the full path to 'big.php','upgrade.php' b...

NPDS <= 5.10 Local Inclusion, XSS, Full path disclosure

// Script Web -------- www.npds.org versions --- NPDS = 5.10 Solutions -- None official Note ------- Vendor has been contacted // Local Inclusion http://.../header.php?DefaultTheme=../apache/logs/error.log00...

CVE-2006-2893

index.php in GANTTy 1.0.3 allows remote attackers to obtain the full path of the web server via an invalid lang parameter in an authenticate action...

CVE-2006-2893

CVE-2006-2893 affects GANTTy 1.0.3. The vulnerability occurs via an invalid lang parameter in an authenticate action, allowing remote attackers to obtain the full path of the web server. This is a path disclosure issue limited to the affected module/function and is documented across multiple sour...