CVE-2008-3786

Cross-site scripting XSS vulnerability in index.php in PICTURESPRO Photo Cart 3.9 allows remote attackers to inject arbitrary web script or HTML via the qtitle parameter aka "Gallery or event name" field in a search action...

CVE-2008-3786

The CVE-2008-3786 entry concerns a Cross-site Scripting (XSS) vulnerability in index.php of PICTURESPRO Photo Cart 3.9. The issue arises from the qtitle parameter (Gallery or event name) in a search action, where user-supplied input is not properly sanitized, enabling an attacker to inject arbitr...

CVE-2008-3788

CVE-2008-3788 affects PICTURESPRO Photo Cart 3.9. Multiple SQL injection vulnerabilities exist when magic_quotes_gpc is disabled. Attack vectors include remote requests to search.php with qtitle, qid, qyear and to _login.php with email/password, enabling arbitrary SQL execution. Overall CVSS 2.0 ...

CVE-2008-3788

Multiple SQL injection vulnerabilities in PICTURESPRO Photo Cart 3.9, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 qtitle, 2 qid, and 3 qyear parameters to a search.php, and the 4 email and 5 password parameters to b login.php...

PicturesPro Photo Cart SQL注入漏洞

BUGTRAQ ID: 30786 CNCAN ID：CNCAN-2008082207 PICTURESPRO Photo Cart是一款基于PHP的WEB应用程序。 PICTURESPRO Photo Cart不正确过滤用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，获得敏感信息或操作数据库。 问题是脚本对用户提交的WEB参数缺少过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。 PICTURESPRO Photo Cart 3.9 目前没有解决方案提供： http://www.picturespro.com/...

PicturesPro Photo Cart 3.9 - Search Cross-Site Scripting

PicturesPro Photo Cart 3.9 - Search Cross-Site Scripting source: https://www.securityfocus.com/bid/30798/info Photo Cart is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data. An attacker may leverage this issue to execute arbitrary...

Gallery < 1.5.8 modules.php phpEx Parameter Traversal Local File Inclusion

Binary data 4619.prm...

CVE-2008-3511

CVE-2008-3511 affects Softbiz Image Gallery (Photo Gallery). It describes multiple cross-site scripting (XSS) vulnerabilities that permit remote attackers to inject arbitrary script or HTML via the latest parameter to index.php, images.php, suggest_image.php, and image_desc.php; and via the msg p...

CVE-2008-3486

Directory traversal vulnerability in the usergetprofile function in include/functions.inc.php in Coppermine Photo Gallery CPG 1.4.18 and earlier, when the charset is utf-8, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the lang part of serialized data in...

Directory traversal

Directory traversal vulnerability in the usergetprofile function in include/functions.inc.php in Coppermine Photo Gallery CPG 1.4.18 and earlier, when the charset is utf-8, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the lang part of serialized data in...

CVE-2008-3486

CVE-2008-3486 : In Coppermine Photo Gallery (CPG) 1.4.18 and earlier, when the charset is utf-8, the _data cookie’s serialized data can be crafted to alter the lang parameter, allowing remote attackers to trigger a directory traversal via .. in include/functions.inc.php/upon the lang data being p...

CVE-2008-3486

Directory traversal vulnerability in the usergetprofile function in include/functions.inc.php in Coppermine Photo Gallery CPG 1.4.18 and earlier, when the charset is utf-8, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the lang part of serialized data in...

Information disclosure

themes/sample/theme.php in Coppermine Photo Gallery CPG 1.4.18 and earlier allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message...

CVE-2008-3481

themes/sample/theme.php in Coppermine Photo Gallery CPG 1.4.18 and earlier allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message...

CVE-2008-3481

themes/sample/theme.php in Coppermine Photo Gallery CPG 1.4.18 and earlier allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message...

CVE-2008-3481

The CVE-2008-3481 issue affects Coppermine Photo Gallery (CPG) 1.4.18 and earlier. A flaw in themes/sample/theme.php allows remote attackers to reveal the installation path via a crafted direct request, causing information disclosure. The CVSS vectors indicate Network access, low attack complexit...

Softbiz Image Gallery - cleanup.php?msg Cross-Site Scripting

Softbiz Image Gallery - cleanup.php?msg Cross-Site Scripting source: https://www.securityfocus.com/bid/30546/info Softbiz Photo Gallery is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to...

Softbiz Image Gallery - adminhome.php?msg Cross-Site Scripting

Softbiz Image Gallery - adminhome.php?msg Cross-Site Scripting source: https://www.securityfocus.com/bid/30546/info Softbiz Photo Gallery is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues t...

Softbiz Image Gallery - image_desc.php?latest Cross-Site Scripting

Softbiz Image Gallery - imagedesc.php?latest Cross-Site Scripting source: https://www.securityfocus.com/bid/30546/info Softbiz Photo Gallery is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issue...

Softbiz Image Gallery - suggest_image.php Multiple Cross-Site Scripting Vulnerabilities

Softbiz Image Gallery - suggestimage.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/30546/info Softbiz Photo Gallery is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may...