[KAPDA::#27] - Runcms 1.x Cross_Site_Scripting vulnerability

KAPDA::27 - Runcms 1.x CrossSiteScripting vulnerability KAPDA New advisory Vulnerable products : Runcms 1.x Vendor: www.runcms.org Risk: Low Vulnerabilities: CrossSiteScripting Discoverd by Roozbeh Afrasiabi roozbehatyahoodotcom www.kapda.ir www.persiax.com Date : -------------------- Found : Jan...

CVE-2006-0875: Undefined Security Weakness

Cross-site scripting vulnerability in ratefile.php in RunCMS 1.3a5 allows remote attackers to inject arbitrary web script or HTML via the lid parameter...

RunCMS 1.x - Ratefile.php Cross-Site Scripting

RunCMS 1.x - Ratefile.php Cross-Site Scripting source: https://www.securityfocus.com/bid/16769/info RunCMS is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to have...

RunCMS 1.x - 'Ratefile.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/16769/info RunCMS is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code executed in the browser of an...

RUNCMS1.3a-sql.tyxt

refrence: http://www.runcms.org/public/modules/forum/viewtopic.php?topicid=4003&forum=18 http://hamid.ir/security/ ----------------------------------------------- RUNCMS 1.3a SQL injection Runcms Includes most things a webmaster would expect from a cms: downloads, links, tutorials section, polls,...

RUNCMS 1.3a SQL injection

refrence: http://www.runcms.org/public/modules/forum/viewtopic.php?topicid=4003&forum=18 http://hamid.ir/security/ ----------------------------------------------- RUNCMS 1.3a SQL injection Runcms Includes most things a webmaster would expect from a cms: downloads, links, tutorials section, polls,...

CVE-2006-0721

SQL injection vulnerability in pmlite.php in RunCMS 1.2 and 1.3a allows remote attackers to execute arbitrary SQL commands via the touserid parameter...

Sql injection

SQL injection vulnerability in pmlite.php in RunCMS 1.2 and 1.3a allows remote attackers to execute arbitrary SQL commands via the touserid parameter...

CVE-2006-0721

CVE-2006-0721 affects RunCMS versions 1.2 and 1.3a, with a vulnerability in pmlite.php that allows remote SQL execution via the to_userid parameter. The NVD entry lists a CVSS v2 base score of 7.5 (HIGH) , with network attack vector, low complexity, and no authentication required. Impacts are des...

CVE-2006-0721

SQL injection vulnerability in pmlite.php in RunCMS 1.2 and 1.3a allows remote attackers to execute arbitrary SQL commands via the touserid parameter...

CVE-2006-0721: Undefined Security Weakness

SQL injection vulnerability in pmlite.php in RunCMS 1.2 and 1.3a allows remote attackers to execute arbitrary SQL commands via the touserid parameter...

[SA18831] RunCMS pmlite.php SQL Injection Vulnerability

TITLE: RunCMS pmlite.php SQL Injection Vulnerability SECUNIA ADVISORY ID: SA18831 VERIFY ADVISORY: http://secunia.com/advisories/18831/ CRITICAL: Moderately critical IMPACT: Manipulation of data WHERE: From remote SOFTWARE: Runcms 1.x http://secunia.com/product/4808/ DESCRIPTION: Hamid Ebadi has...

RunCMS 1.21.3 - PMLite.php SQL Injection

RunCMS 1.21.3 - PMLite.php SQL Injection source: https://www.securityfocus.com/bid/16652/info RunCMS is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation coul...

RunCMS 1.2/1.3 - 'PMLite.php' SQL Injection

source: https://www.securityfocus.com/bid/16652/info RunCMS is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation could allow an attacker to compromise the...

Design/Logic Flaw

Multiple PHP remote file include vulnerabilities in RunCMS 1.2 and earlier, with registerglobals and allowurlfopen enabled, allow remote attackers to execute arbitrary code via the bbPathpath parameter in 1 class.forumposts.php and 2 forumpollrenderer.php...

CVE-2006-0659

Multiple PHP remote file include vulnerabilities in RunCMS 1.2 and earlier, with registerglobals and allowurlfopen enabled, allow remote attackers to execute arbitrary code via the bbPathpath parameter in 1 class.forumposts.php and 2 forumpollrenderer.php...

CVE-2006-0659

Multiple PHP remote file include vulnerabilities in RunCMS 1.2 and earlier, with registerglobals and allowurlfopen enabled, allow remote attackers to execute arbitrary code via the bbPathpath parameter in 1 class.forumposts.php and 2 forumpollrenderer.php...

CVE-2006-0659

CVE-2006-0659 concerns multiple PHP remote code execution vulnerabilities in RunCMS 1.2 and earlier, arising when register_globals and allow_url_fopen are enabled. An attacker can trigger arbitrary code execution via the bbPath[path] parameter in (1) class.forumposts.php and (2) forumpollrenderer...

CVE-2006-0658

Vulnerability family: incomplete blacklist in FCKeditor. Affected: FCKeditor 2.0/2.2 as used in RunCMS and related products. Issue: remote attackers can upload and execute arbitrary script files by using extensions not listed in Config[DeniedExtensions][File] (e.g., .php.txt) due to inadequate ex...

runCMS <= 1.3a2 possible remote code execution through the integrated FCKEditor package

--- RunCMS = 1.3a2 remote code execution ------------------------------------ software: site: http://www.runcms.org/public/modules/news/ description: "RUNCMS E-Xoops is a extensible content management system based on the v1 core of Xoops"...