CVE-2006-1685: Undefined Security Weakness

Multiple SQL injection vulnerabilities in modules.php in APT-webshop-system 4.0 PRO, 3.0 BASIC, and 3.0 LIGHT allow remote attackers to execute arbitrary SQL commands via the 1 group, 2 seite, and 3 id parameter, possibly involving the artikel functionality. NOTE: this vulnerability also allows...

CVE-2006-1677: Exposure of Sensitive Information to an Unauthorized Actor

MAXdev MDPro 1.0.73 and 1.0.72, and possibly other versions before 1.076, allows remote attackers to obtain the full path of the server via a direct request to includes/legacy.php...

CVE-2006-1680: Undefined Security Weakness

Jupiter CMS 1.1.5, when displayerrors is enabled, allows remote attackers to obtain the full server path via a direct request to modules/online.php...

CVE-2006-1635

LucidCMS 2.0.0 RC4 allows remote attackers to obtain sensitive information via a direct request to /lucidphplib/translator.php, which reveals the path in an error message...

Multiple Vulnerabilities in LucidCMS

Multiple Vulnerabilities in LucidCMS Author : Rusydi Hasan M a.k.a : cR45H3R Date : April,1st 2006 Location : Indonesia, Cilacap --- Software description lucidCMS is a simple and flexible content management system for the individual or organization that wishes to manage a collection of web pages...

Full path disclosure in Webcalendar 1.1.0-CVS

Full path disclosure in webcalendar Author : Rusydi Hasan M a.k.a : cR45H3R Location : Indonesia, Cilacap Date : March,28th 2006 Version : 1.1.0-CVS --- software description WebCalendar is a PHP application used to maintain a calendar for one or more persons and for a variety of purposes. ---...

Claroline 1.7.4 - 'scormExport.inc.php' Remote Code Execution

!/usr/bin/php -q -d shortopentag=on works with registerglobals = On & allowurlfopen = On\r\n\r\n"; echo "dork: "Powered by Claroline" -demo\r\n\r\n"; if $argc5 echo "Usage: php ".$argv0." host path location OPTIONS\r\n"; echo "host: target server ip/hostname\r\n"; echo "path: path to...

CVE-2006-1488

ActiveCampaign SupportTrio 2.5 is affected. The issue exposes the server’s full path via error messages when handling (1) invalid article or (2) invalid print parameters in a kb action to index.php, or (3) an invalid category parameter to modules/KB/pdf.php. Root cause: error messages leak path i...

advisory DATALIFE engine

------------------------------------------------ / / DataLife Engine v.3.7 SoftNews Media Group advisory Программный продукт : DataLife Engine v.3.7 SoftNews Media Group Текущее состояние : UNPATCHED Найдена : LTK Дата написания : 29nd March, 2006 Тестировалось : ; Детали : Раскрытие установочног...

CVE-2006-1432

The CVE-2006-1432 entry concerns fusionZONE couponZONE 4.2, where remote attackers can disclose server file paths and other sensitive info through manipulated inputs that trigger SQL-based inference. Root cause: improper input handling allowing SQL manipulation leading to information disclosure. ...

Clever Copy 2.x Multiple Vulnerabilities - Active Check

Clever Copy is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2005 Josh Zlatin-Amishav Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PHP Surveyor Multiple Vulnerabilities - Active Check

PHP Surveyor is prone to multiple vulnerabilities that can lead to SQL injection, path disclosure and cross-site scripting XSS. SPDX-FileCopyrightText: 2005 Josh Zlatin-Amishav Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Design/Logic Flaw

AdMan 1.0.20051221 and earlier allows remote attackers to obtain the full path via 1 a blank campaignId parameter to editCampaign.php and 2 a blank schemeId parameter to viewPricingScheme.php...

CVE-2006-1375

AdMan 1.0.20051221 and earlier allows remote attackers to obtain the full path via 1 a blank campaignId parameter to editCampaign.php and 2 a blank schemeId parameter to viewPricingScheme.php...

CVE-2006-1375

AdMan 1.0.20051221 and earlier allows remote attackers to obtain the full path via 1 a blank campaignId parameter to editCampaign.php and 2 a blank schemeId parameter to viewPricingScheme.php...

CVE-2006-1375

CVE-2006-1375 affects AdMan 1.0.20051221 and earlier. The vulnerability allows remote attackers to obtain the full server path via (1) a blank campaignId parameter to editCampaign.php and (2) a blank schemeId parameter to viewPricingScheme.php. Affected components are the PHP scripts handling cam...

CVE-2006-1375: Undefined Security Weakness

AdMan 1.0.20051221 and earlier allows remote attackers to obtain the full path via 1 a blank campaignId parameter to editCampaign.php and 2 a blank schemeId parameter to viewPricingScheme.php...

CVE-2006-1340

CVE-2006-1340 affects CuteNews 1.4.1 (and possibly earlier) and involves a remote path-disclosure vulnerability. The description notes that an invalid file path could allow an attacker to obtain the installation path via unspecified vectors. The CVSS basis from NVD is 5.0 (Medium) with network ac...

Noah's Classifieds Multiple Path Disclosure and Cross Site Scripting Vulnerabilities

I have contacted PhpOutsourcing 2 weeks ago, and they didn't answer. The mail I sent on classifieds AT phpoutsourcing DOT com bounced back in error. The one I sent on askme AT phpoutsourcing DOT com never got replied. "Currently, we are completely overloaded with our running projects, and we don'...

Path Disclosure and Arbitrary File Read Vulnerability in SLAB5000

Description SLAB500 is a complete, dynamic, modular web-system designed to your specifications, allowing you to quickly and conveniently update all your content, add new pages, upload images, sounds and video from any browser, via our front-end interface from any location that you have web access...