Partial Links v1.2.2

Partial Links v1.2.2 Homepage: http://www.particlesoft.net/particlelinks/ Effected files: index.php pagefooter.php admin.php Exploits & Vulnerabilities: Possible directory traversal?: http://www.example.com/OtherSites/X2526Y/../../../../../etc/passwd/ SQL Injection:...

GANTTy v1.0.3

GANTTy v1.0.3 Homepage: http://www.gantty.com Effected files: index.php XSS Vulnerabilities PoC: XSS Vulnerability: http://www.example.com/index.php?action=login&message=IMG SRC=javascript:alert'XSS'+email&lang= Full path disclosure error: http://www.example.com/index.php?action=authenticate&lang...

CVE-2005-2463

Kayako LiveResponse 2.x vulnerability (CVE-2005-2463) lets remote attackers obtain sensitive information by directly requesting addressbook.php and other include scripts, with the path exposed in an error message. Affected software: Kayako LiveResponse 2.x. Impact: information disclosure with par...

Design/Logic Flaw

An unspecified script in EVA-Web 2.1.2 and earlier, probably index.php, allows remote attackers to obtain the full path of the web server via invalid 1 perso or 2 aide parameters...

CVE-2006-2698

Geeklog 1.4.0sr2 and earlier allows remote attackers to obtain the full installation path via a direct request and possibly invalid arguments to 1 layout/professional/functions.php or 2 getimage.php...

CVE-2006-2698

Geeklog 1.4.0sr2 and earlier allows remote attackers to obtain the full installation path via a direct request and possibly invalid arguments to 1 layout/professional/functions.php or 2 getimage.php...

[KAPDA::#45] - geeklog multiple vulnerabilities

KAPDA New advisory Vendor: http://www.geeklog.net Bugs: Path Disclosure, XSS, SQL Injection Authentication bypass Vulnerable Version: geeklog-1.4.0sr2prior versions also may be affected Exploitation: Remote with browser Description: -------------------- geeklog is a freely available PHP-based web...

Sql injection

SQL injection vulnerability in Alstrasoft Article Manager Pro 1.6 allows remote attackers to execute arbitrary SQL commands via 1 the authorid parameter in profile.php and 2 the autid parameter in userarticles.php. NOTE: the autid vector can produce resultant path disclosure if the SQL manipulati...

CVE-2006-2565

SQL injection vulnerability in Alstrasoft Article Manager Pro 1.6 allows remote attackers to execute arbitrary SQL commands via 1 the authorid parameter in profile.php and 2 the autid parameter in userarticles.php. NOTE: the autid vector can produce resultant path disclosure if the SQL manipulati...

CVE-2006-2565

SQL injection vulnerability in Alstrasoft Article Manager Pro 1.6 allows remote attackers to execute arbitrary SQL commands via 1 the authorid parameter in profile.php and 2 the autid parameter in userarticles.php. NOTE: the autid vector can produce resultant path disclosure if the SQL manipulati...

Destiney Links Script v2.1.2

Destiney Links Script v2.1.2 - XSS Vulnv & Full path errors. Homepage: http://destiney.com/scripts Description: Destiney Links is an Open Source project written in PHP for use with the MySQL Server entity. Links provides a pre-built, dynamically generated, Link site. Links counts referrers in and...

[KAPDA::#43] - phpwcms multiple vulnerabilities

Vendor: http://www.phpwcms.de Bugs: Path Disclosure, XSS, Local File Inclusion, Remote Code Execution Vulnerable Version: phpwcms 1.2.5-DEV prior versions also maybe affected Exploitation: Remote with browser Description: -------------------- phpwcms is a web content management system optimized f...

CVE-2006-2535

CVE-2006-2535 affects the Destiney Links Script 2.1.2. The vulnerable component is index.php, where an invalid show parameter referencing a non-existent file leads to an error message that reveals the installation path. The notes suggest this could be related to a broader directory traversal issu...

CVE-2006-2534

Destiny Links Script 2.1.2 is vulnerable to information disclosure: remote attackers can obtain the installation path by direct URLs to files under include and themes/original. The issue stems from inadequate protection of library/support files. No exploit details or remediation are provided in t...

CVE-2006-2535

index.php in Destiney Links Script 2.1.2 allows remote attackers to obtain the installation path via an invalid show parameter referencing a non-existent file, which reveals the path in the resulting error message. NOTE: this issue might be resultant from a more serious issue such as directory...

CVE-2006-2532

stats.php in Destiney Rated Images Script 0.5.0 allows remote attackers to obtain the installation path via an invalid s parameter, which displays the path in an error message. NOTE: this issue was originally claimed to be SQL injection, but CVE analysis shows that the problem is related to an...

CVE-2006-2532

The CVE-2006-2532 entry concerns Destiney Rated Images Script 0.5.0. The affected component is stats.php where an invalid s parameter can cause an error message to reveal the installation path. The description notes this was initially claimed to be SQL injection, but CVE analysis attributes the i...

Yourfreeworld.com Short Url & Url Tracker Script

This is the second script I've tested from these people. It will be assumed for right now that all of their scripts contain full path disclosure errors as well as XSS'ing Yourfreeworld.com Short Url & Url Tracker Script Homepage: http://www.yourfreeworld.com/script/shorturl.asp Short Url Service...

Myspace Friend Train v2.8

Myspace Friend Train v2.8 Full path disclosure & possible SQL injection. BRBR Its possible to put ' in the input myspace ID box to get the error. Example of the error is below: BRBR bInvalid query: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server versio...

CVE-2006-2438

CVE-2006-2438 is a directory traversal in Resin’s viewfile servlet (resin-doc) affecting Resin 3.0.17 and 3.0.18. An unauthenticated remote attacker can read arbitrary files under other web roots via the contextpath parameter, with potential path disclosure when the parameter is invalid. The issu...