CVE-2006-2080

SQL injection vulnerability in portfoliophotopopup.php in Verosky Media Instant Photo Gallery 1.0.2 allows remote attackers to execute arbitrary SQL commands via the id parameter, which is not cleansed before calling the countclick function in includes/functions/fnsstd.php. NOTE: this issue could...

CVE-2006-2080

CVE-2006-2080 affects Verosky Media Instant Photo Gallery 1.0.2. The vulnerability is an SQL injection in portfolio_photo_popup.php (id parameter) that is not cleansed before calling count_click in includes/functions/fns_std.php, allowing remote attackers to execute arbitrary SQL commands. The no...

CVE-2006-2079

CVE-2006-2079 describes a cross-site scripting (XSS) vulnerability in Verosky Media Instant Photo Gallery, specifically in portfolio.php, potentially affecting versions before 1.0.2. The flaw is exploitable via the cat_id parameter, enabling remote attackers to inject arbitrary web script or HTML...

CVE-2006-2079

Cross-site scripting XSS vulnerability in portfolio.php in Verosky Media Instant Photo Gallery, possibly before 1.0.2, allows remote attackers to inject arbitrary web script or HTML via the catid parameter...

CVE-2006-2079: Undefined Security Weakness

Cross-site scripting XSS vulnerability in portfolio.php in Verosky Media Instant Photo Gallery, possibly before 1.0.2, allows remote attackers to inject arbitrary web script or HTML via the catid parameter...

CVE-2006-2080: Undefined Security Weakness

SQL injection vulnerability in portfoliophotopopup.php in Verosky Media Instant Photo Gallery 1.0.2 allows remote attackers to execute arbitrary SQL commands via the id parameter, which is not cleansed before calling the countclick function in includes/functions/fnsstd.php. NOTE: this issue could...

Cross site scripting

Cross-site scripting XSS vulnerability in Verosky Media Instant Photo Gallery allows remote attackers to inject arbitrary web script or HTML via the member parameter in a viewpro action in member.php. NOTE: the original report may be inaccurate, since the "viewpro" string does not appear in the...

CVE-2006-2052

Cross-site scripting XSS vulnerability in Verosky Media Instant Photo Gallery allows remote attackers to inject arbitrary web script or HTML via the member parameter in a viewpro action in member.php. NOTE: the original report may be inaccurate, since the "viewpro" string does not appear in the...

CVE-2006-2052

CVE-2006-2052 : XSS vulnerability in Verosky Media Instant Photo Gallery. The issue is exploitable via the member parameter in a viewpro action in member.php . This aligns with the NVD description and CVSS 2.0 base score of 5.8 (Medium), affecting confidentiality and integrity. A note in the desc...

CVE-2006-2052: Undefined Security Weakness

Cross-site scripting XSS vulnerability in Verosky Media Instant Photo Gallery allows remote attackers to inject arbitrary web script or HTML via the member parameter in a viewpro action in member.php. NOTE: the original report may be inaccurate, since the "viewpro" string does not appear in the...

Instant Photo Gallery <= Multiple XSS

==================== Discovered by: Qex Date: 25 April 2006 ==================== /member.php?action=viewpro&member=XSS...

Instant Photo Gallery 1.0 - member.php?member Cross-Site Scripting

Instant Photo Gallery 1.0 - member.php?member Cross-Site Scripting source: https://www.securityfocus.com/bid/17696/info Instant Photo Gallery is prone to multiple cross-site scripting vulnerabilities. These issues are due to the application's failure to properly sanitize user-supplied input. An...

Instant Photo Gallery 1.0 - portfolio.php?cat_id Cross-Site Scripting

Instant Photo Gallery 1.0 - portfolio.php?catid Cross-Site Scripting source: https://www.securityfocus.com/bid/17696/info Instant Photo Gallery is prone to multiple cross-site scripting vulnerabilities. These issues are due to the application's failure to properly sanitize user-supplied input. An...

Instant Photo Gallery 1.0 - 'portfolio_photo_popup.php?id' Cross-Site Scripting

source: https://www.securityfocus.com/bid/17696/info Instant Photo Gallery is prone to multiple cross-site scripting vulnerabilities. These issues are due to the application's failure to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code...

coppermine -- "file" Local File Inclusion Vulnerability

Secunia reports: Coppermine Photo Gallery have a vulnerability, which can be exploited by malicious people to disclose sensitive information. Input passed to the "file" parameter in "index.php" isn't properly verified, before it is used to include files. This can be exploited to include arbitrary...

- PHPGraphy <= 0.9.11 "editwelcome" unauthorized access / cross site scripting -

PHPGraphy = 0.9.11 "editwelcome" unauthorized access / cross site scripting - -------------------------------- software site: http://phpgraphy.sourceforge.net/ description: "Full featured photo gallery PHP script - Light, fast and easy to install" vulnerable code index.php near line 503-10:...

Coppermine Photo Gallery index.php file Parameter Local File Inclusion

The version of Coppermine Gallery installed on the remote host fails to properly sanitize input to the 'file' parameter of the 'index.php' script before using it in a PHP 'includeonce' function. Regardless of PHP's 'registerglobals' setting, an unauthenticated attacker may be able to exploit this...

[KAPDA]CopperminePhotoGallery1.4.4~ PluginInclusionSystem(index.php)~ RemoteFileInclusion attack

ORIGINAL ADVISORY: http://myimei.com/security/2006-04-14/copperminephotogallery144-plugininclusionsystemindexphp-remotefileinclusion-attack.html ——————-Summary—————- Software: CPG Coppermine Photo Gallery Sowtware’s Web Site: http://coppermine.sourceforge.net/ Versions: 1.4.4.stable Class: Remote...

CVE-2006-1667

Summary: CVE-2006-1667 affects Eric Gerdes Crafty Syntax Image Gallery (CSIG) up to version 3.1g. The vulnerability is a SQL injection in slides.php caused when the variable $projectid is less than 1, which prevents the limitquery_s parameter from being set. This enables remote authenticated user...

[Full-disclosure] [SECURITY] [DSA 989-1] New zoph packages fix SQL injection

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 989-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff March 9th, 2006 http://www.debian.org/security/faq -...