CVE-2006-2178

CVE-2006-2178 affects CyberBuild with multiple cross-site scripting (XSS) vulnerabilities. The affected components are the login.asp page (SessionID parameter), browse0.htm (ProductIndex parameter), and result.asp (rowcolor and heading parameters). The description notes that vectors 1 and 2 may b...

CVE-2006-1908

Cross-site scripting vulnerability in addevent.php in myEvent 1.x allows remote attackers to inject arbitrary web script or HTML via the eventdesc parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2006-1910

config.php in S9Y Serendipity 1.0 beta 2 allows remote attackers to inject arbitrary PHP code by editing values that are stored in config.php and later executed. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2006-1910

This CVE affects S9Y Serendipity 1.0 beta 2, where config.php values stored by the application can be edited to inject and later execute arbitrary PHP code. The underlying issue is PHP code execution triggered by manipulated config.php content, enabling remote code execution with likely impact to...

CVE-2006-1841

Cross-site scripting XSS vulnerability in search.php in boastMachine bMachine 2.7, and possibly other versions before 2.9b, allows remote attackers to inject arbitrary web script or HTML via the key parameter, as used by the search field...

pajax-0.5.1.txt

Advisory: PAJAX Remote Code Injection and File Inclusion Vulnerability RedTeam has identified two security flaws in PAJAX. It is possible to execute arbitrary PHP code from unchecked user input. Additionally, it is possible to include arbitrary files on the server ending in ".class.php". Details...

CVE-2005-4780

Cross-site scripting XSS vulnerability in Fidra Lighthouse CMS 1.1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the search parameter in a querystring to the home page. NOTE: The vendor disputes this issue, saying "Lighthouse does not in any way make use of the...

[Full-disclosure] PAJAX Remote Code Injection and File Inclusion Vulnerability

Advisory: PAJAX Remote Code Injection and File Inclusion Vulnerability RedTeam has identified two security flaws in PAJAX. It is possible to execute arbitrary PHP code from unchecked user input. Additionally, it is possible to include arbitrary files on the server ending in ".class.php". Details...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Advanced Poll 2.02 allow remote attackers to inject arbitrary web script or HTML via the 1 id parameter to comments.php or 2 pollid parameter to page.php. NOTE: it is possible that this issue is resultant from CVE-2006-1616...

Cross site scripting

Cross-site scripting XSS vulnerability in login.php in Phoetux.net PhxContacts 0.93.1 beta and earlier allows remote attackers to inject arbitrary web script or HTML via the m parameter...

CVE-2006-1429

The vulnerability CVE-2006-1429 is a Cross-site Scripting (XSS) issue in classifiedZONE 1.2 and earlier . It affects the file accountlogon.cfm where an attacker can inject arbitrary web script or HTML through the rtn parameter. Public references confirm the XSS impact but do not provide remediati...

Cross site scripting

Cross-site scripting XSS vulnerability in apwcwinmain.jsp in the web console in IBM Tivoli Business Systems Manager TBSM before 3.1.0.1 allows remote attackers to inject arbitrary web script or HTML via the skin parameter...

CVE-2006-1233

Multiple cross-site scripting XSS vulnerabilities in WMNews allow remote attackers to inject arbitrary web script or HTML via the 1 ArtCat parameter to wmview.php, 2 ctrrowcol parameter to footer.php, or 3 ArtID parameter to wmcomments.php...

CVE-2006-1205

CVE-2006-1205 affects myWebland myBloggie 2.1.3 beta and earlier, with multiple reflected XSS flaws in PHP scripts (delcomment.php, upload.php, addcat.php, edituser.php, adduser.php, editcat.php, add.php, deluser.php, delcat.php, del.php) reachable via admin.php. Parameters include confirmredirec...

CVE-2006-1087

Direct static code injection vulnerability in the modifyconfig action in admin.php for PHP-Stats 0.1.9.1 and earlier allows remote authenticated administrators to execute arbitrary PHP code via the optionnewcompatibilitymode parameter, which is not filtered before being stored in config.php. NOTE...

CVE-2006-1071

The CVE-2006-1071 entry concerns DVguestbook 1.2.2. An XSS flaw exists in index.php through the page parameter, allowing remote attackers to inject arbitrary web script or HTML. The NVD entry assigns a base CVSS v2 score of 4.3 (MEDIUM) with Network attack vector, Medium attack complexity, no pri...

CVE-2006-1040

Cross-site scripting XSS vulnerability in vBulletin 3.0.12 and 3.5.3 allows remote attackers to inject arbitrary web script or HTML via the email field, which is injected in profile.php but not sanitized in sendmsg.php...

PEHEPE Membership Management System 3.0 - Remote PHP Script Code Injection

source: https://www.securityfocus.com/bid/16887/info PEHEPE Membership Management System is prone to a remote PHP code-injection vulnerability. An attacker can exploit this issue to facilitate a compromise of the application and the underlying system; other attacks are also possible. PEHEPE...

CVE-2006-0188

webmail.php in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to inject arbitrary web pages into the right frame via a URL in the rightframe parameter. NOTE: this has been called a cross-site scripting XSS issue, but it is different than what is normally identified as XSS...

CVE-2006-0735

CVE-2006-0735 describes a cross-site scripting (XSS) vulnerability in BBcode.pm within M. Blom HTML::BBCode 1.04 and earlier. The flaw allows remote attackers to inject arbitrary JavaScript via a javascript: URI in (1) the img tag or (2) the url tag of BBCode, when used in products such as My Blo...