CVE-2006-0519

SPIP 1.8.2-e and earlier and 1.9 Alpha 2 5539 and earlier allows remote attackers to obtain sensitive information via a direct request to inc-messforum.php3, which reveals the path in an error message...

Limbo CMS Multiple Vulnerabilities

The remote host is running Limbo CMS, a content-management system written in PHP. The remote version of this software is vulnerable to several flaws including : - If registerglobals is off and Limbo is configured to use a MySQL backend, then a SQL injection is possible due to improper sanitizatio...

CVE-2006-0445

CVE-2006-0445 affects Phpclanwebsite 1.23.1. Affected component: uploader page handling on index.php. Description shows remote authenticated users can obtain the installation path by supplying an invalid filename (example: “\”), which displays the full path of uploader.php, suggesting a possible ...

CVE-2006-0327

TYPO3 3.7.1 allows remote attackers to obtain sensitive information via a direct request to 1 thumbs.php, 2 showpic.php, or 3 tables.php, which causes them to incorrectly define a variable and reveal the path in an error message when a require function call fails...

EZDatabase.txt

Synopsis: EZDatabase directory transversal, XSS and path disclosure vulnerability Product: EZDatabase http://www.ezdatabase.org Version: Confirmed on EZDatabase 2.1.2 Author: Josh Zlatin-Amishav Date: January 15, 2006 Background: Written in PHP and MySQL, ezDatabase is the foundation for your...

Directory traversal

index.php in EZDatabase before 2.1.2 does not properly cleanse the p parameter before constructing and including a .php filename, which allows remote attackers to conduct directory traversal attacks, and produces resultant cross-site scripting XSS and path disclosure...

CVE-2006-0315

CVE-2006-0315 affects EZDatabase prior to 2.1.2. The vulnerability stems from improper cleansing of the p parameter when constructing and including a .php filename, enabling directory traversal. This can lead to cross-site scripting (XSS) and path disclosure. The available connected documents pro...

CVE-2005-4638

The CVE-2005-4638 entry involves Kayako SupportSuite 3.00.26 and earlier where the index.php in multiple modules (news, downloads, knowledgebase) can reveal the full server path via specific parameters: _a, newsid, downloaditemid, kbarticleid. This is a path disclosure vulnerability in the affect...

Trustix Secure Linux Security Advisory 2005.23

Multiple Vulnerabilities in brainsquad-team's CMS ================================================= Discovered on 23.12.2005 by yorn. Merry Christmas! Description: ------------ www.brainsquad-team.de The CMS from brainsquad-team is a php / sql based CMS system. Problems: -------- XSS: There are...

CVE-2006-0113

Enhanced Simple PHP Gallery 1.7 allows remote attackers to obtain the full path of the application via a direct request to sphelperfunctions.php, which leaks the pathname in an error message...

CVE-2006-0113

Enhanced Simple PHP Gallery 1.7 allows remote attackers to obtain the full path of the application via a direct request to sphelperfunctions.php, which leaks the pathname in an error message...

CVE-2006-0113

CVE-2006-0113 affects Enhanced Simple PHP Gallery 1.7. The issue arises when an attacker can trigger a direct request to sp_helper_functions.php, causing an error message to leak the application’s full path (pathname). This is a path-traversal/information-disclosure symptom that could aid targeti...

[ECHO_ADV_25$2006] Full path disclosure on boastMachine v3.1

/ / | | / // / | | Y / | / / /| / / / / / / .OR.ID ECHOADV25$2006 --------------------------------------------------------------------------- ECHOADV25$2006 Full path disclosure on boastMachine v3.1 --------------------------------------------------------------------------- Author : M.Hasran...

phpBB < 2.0.19 Multiple XSS

According to its version number, the remote version of this software is vulnerable to JavaScript injection issues using 'url' bbcode tags and, if HTML tags are enabled, HTML more generally. This may allow an attacker to inject hostile JavaScript into the forum system to steal cookie credentials o...

CVE-2005-4546

CVE-2005-4546 affects eggblog 2.0: the search.php module exposes the server full path to remote attackers via an invalid q parameter, with the description suggesting a possible SQL injection trigger. The concrete impact stated is path disclosure; no additional exploit details are provided in the ...

CVE-2005-4546

search.php in eggblog 2.0 allows remote attackers to obtain the full path via an invalid q parameter, as used by the Keyword and Search fields, possibly due to an SQL injection vulnerability...

phpBB2018.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 phpBB 2.0.18 XSS and Full Path Disclosure cXIb8O3.22 Author: Maksymilian Arciemowicz cXIb8O3 Date: 16.12.2005 from securityreason.com TEAM - --- 0.Description --- phpBB is a high powered, fully scalable, and highly customizable Open Source bulletin...

phpBB Forum program:the old revolution met the new problem-the vulnerability warning-the black bar safety net

phpBB 2.0.18 XSS and Full Path Disclosure Details: SecurityAlert There is a brute force tool, a single thread, there is no useful,it rivals had a what phpbb what also can be used to run the password 下载 :http://ftpzhangxue.w205.100dns.com/tools/phpbb.rar Topic : phpBB 2.0.18 XSS and Full Path...

CVE-2005-4508

Nexus Concepts Dev Hound 2.24 and earlier allows remote attackers to obtain the installation path via a URL containing a non-existent .dll file...

CVE-2005-4495

The advisory concerns SpireMedia mx7, specifically the index.cfm script, where the cid parameter is vulnerable to SQL injection. The root cause is untrusted input used in SQL queries, enabling remote attackers to potentially run arbitrary SQL commands. Some sources also suggest this may illuminat...