CVE-2006-1680

CVE-2006-1680 affects Jupiter CMS 1.1.5. When display_errors is enabled, an attacker can trigger a direct request to modules/online.php and obtain the full server path, exposing a local file disclosure issue. The vulnerability is rooted in how errors are disclosed and can lead to information disc...

CVE-2006-1680

Jupiter CMS 1.1.5, when displayerrors is enabled, allows remote attackers to obtain the full server path via a direct request to modules/online.php...

Shopweezle 2.0 multiple vuln.

Shopweezle 2.0 multiple vuln. Vuln. discovered by : r0t Date: 9 april 2006 vendor:http://shopweezle.de/ affected versions: ShopWeezle PERSONAL ShopWeezle PROFESSIONAL ShopWeezle PROFESSIONAL+ orginal advisory: http://pridels.blogspot.com/2006/04/shopweezle-20-multiple-vuln.html Vuln. description:...

PT-2006-2671 · Maxdev · Maxdev Md-Pro

Name of the Vulnerable Software and Affected Versions: MAXdev MDPro versions prior to 1.076 Description: The issue allows remote attackers to obtain the full path of the server via a direct request to "includes/legacy.php". Recommendations: For versions prior to 1.076, consider restricting access...

APT-webshop-system vuln.

APT-webshop-system vuln. Vuln. discovered by : r0t Date: 9 april 2006 vendor:http://www.apt-webservice.de/shopsoftware/ affected versions: 4.0 PRO 3.0 BASIC 3.0 LIGHT orginal advisory: http://pridels.blogspot.com/2006/04/apt-webshop-system-vuln.html Vuln. description: 1. SQL injection vuln...

MAXDEV CMS Multiple vulnerabilities

Full Path disclosure --------------------- This hole is caused by direct access to file includes/legacy.php not protected PoC : http://site.co.id/maxdev/includes/legacy.php Fix : Turn off display error in php.ini can fix this security issue Blind sql inject ----------------- This hole is caused b...

Multiple vulnerability in jupiter CMS

Author : KaDaL-X email : [email protected] site : http://kandangjamur.net/ Multiple vulnerability in jupiter CMS Vendor : http://www.highstrike.net/ version 1.1.5 Vulnerability code found in file modules/online.php PoC: XSS...

CVE-2006-1635

LucidCMS 2.0.0 RC4 allows remote attackers to obtain sensitive information via a direct request to /lucidphplib/translator.php, which reveals the path in an error message...

Multiple Vulnerabilities in LucidCMS

Multiple Vulnerabilities in LucidCMS Author : Rusydi Hasan M a.k.a : cR45H3R Date : April,1st 2006 Location : Indonesia, Cilacap --- Software description lucidCMS is a simple and flexible content management system for the individual or organization that wishes to manage a collection of web pages...

Full path disclosure in Webcalendar 1.1.0-CVS

Full path disclosure in webcalendar Author : Rusydi Hasan M a.k.a : cR45H3R Location : Indonesia, Cilacap Date : March,28th 2006 Version : 1.1.0-CVS --- software description WebCalendar is a PHP application used to maintain a calendar for one or more persons and for a variety of purposes. ---...

Claroline 1.7.4 - 'scormExport.inc.php' Remote Code Execution

!/usr/bin/php -q -d shortopentag=on works with registerglobals = On & allowurlfopen = On\r\n\r\n"; echo "dork: "Powered by Claroline" -demo\r\n\r\n"; if $argc5 echo "Usage: php ".$argv0." host path location OPTIONS\r\n"; echo "host: target server ip/hostname\r\n"; echo "path: path to...

CVE-2006-1488

ActiveCampaign SupportTrio 2.5 is affected. The issue exposes the server’s full path via error messages when handling (1) invalid article or (2) invalid print parameters in a kb action to index.php, or (3) an invalid category parameter to modules/KB/pdf.php. Root cause: error messages leak path i...

advisory DATALIFE engine

------------------------------------------------ / / DataLife Engine v.3.7 SoftNews Media Group advisory Программный продукт : DataLife Engine v.3.7 SoftNews Media Group Текущее состояние : UNPATCHED Найдена : LTK Дата написания : 29nd March, 2006 Тестировалось : ; Детали : Раскрытие установочног...

CVE-2006-1432

The CVE-2006-1432 entry concerns fusionZONE couponZONE 4.2, where remote attackers can disclose server file paths and other sensitive info through manipulated inputs that trigger SQL-based inference. Root cause: improper input handling allowing SQL manipulation leading to information disclosure. ...

Clever Copy 2.x Multiple Vulnerabilities - Active Check

Clever Copy is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2005 Josh Zlatin-Amishav Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PHP Surveyor Multiple Vulnerabilities - Active Check

PHP Surveyor is prone to multiple vulnerabilities that can lead to SQL injection, path disclosure and cross-site scripting XSS. SPDX-FileCopyrightText: 2005 Josh Zlatin-Amishav Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Design/Logic Flaw

AdMan 1.0.20051221 and earlier allows remote attackers to obtain the full path via 1 a blank campaignId parameter to editCampaign.php and 2 a blank schemeId parameter to viewPricingScheme.php...

CVE-2006-1375

AdMan 1.0.20051221 and earlier allows remote attackers to obtain the full path via 1 a blank campaignId parameter to editCampaign.php and 2 a blank schemeId parameter to viewPricingScheme.php...

CVE-2006-1375

AdMan 1.0.20051221 and earlier allows remote attackers to obtain the full path via 1 a blank campaignId parameter to editCampaign.php and 2 a blank schemeId parameter to viewPricingScheme.php...

CVE-2006-1375

CVE-2006-1375 affects AdMan 1.0.20051221 and earlier. The vulnerability allows remote attackers to obtain the full server path via (1) a blank campaignId parameter to editCampaign.php and (2) a blank schemeId parameter to viewPricingScheme.php. Affected components are the PHP scripts handling cam...