CVE-2007-3342

CVE-2007-3342 documents multiple XSS flaws in Movable Type (MT) prior to version 3.34. Attack vectors include (1) a malformed SGML numeric character reference with a null byte in a javascript: URI and (2) an element attribute missing the closing '>' in the start tag. The vulnerability allows r...

CVE-2007-3129

CVE-2007-3129 concerns an XSS vulnerability in Utopia News Pro 1.4.0, specifically in login.php where the password parameter can be exploited to inject script/HTML. The vulnerability is described across multiple sources (NVD, CVE records, and Full-Disclosure material), with exploitation details i...

CVE-2007-3227

Cross-site scripting XSS vulnerability in the tojson ActiveRecord::Basetojson function in Ruby on Rails before edge 9606 allows remote attackers to inject arbitrary web script via the input values...

Link Request Contact Form 3.4 Remote Code Execution Vulnerability

No description provided by source. -=--------------------ADVISORY-------------------=- Link Request Contact Form v3.4 Author: CorryL [email protected] -=-----------------------------------------------=- -=+ Application: Link Request Contact Form -=+ Version: 3.4 -=+ Vendor's URL:...

lrcf-inject.txt

-=--------------------ADVISORY-------------------=- Link Request Contact Form v3.4 Author: CorryL [email protected] -=-----------------------------------------------=- -=+ Application: Link Request Contact Form -=+ Version: 3.4 -=+ Vendor's URL:...

Link Request Contact Form 3.4 Remote Code Execution Vulnerability

Exploit for unknown platform in category web applications ================================================================= Link Request Contact Form 3.4 Remote Code Execution Vulnerability ================================================================= -=+ Application: Link Request Contact For...

Link Request Contact Form 3.4 - Remote Code Execution

Link Request Contact Form 3.4 - Remote Code Execution -=--------------------ADVISORY-------------------=- Link Request Contact Form v3.4 Author: CorryL [email protected] -=-----------------------------------------------=- -=+ Application: Link Request Contact Form -=+ Version: 3.4 -=+ Vendor's...

Link Request Contact Form 3.4 - Remote Code Execution

-=--------------------ADVISORY-------------------=- Link Request Contact Form v3.4 Author: CorryL [email protected] -=-----------------------------------------------=- -=+ Application: Link Request Contact Form -=+ Version: 3.4 -=+ Vendor's URL:...

Cross site scripting

Cross-site scripting XSS vulnerability in RM EasyMail Plus allows remote attackers to inject arbitrary web script or HTML via the title field in an email...

EUVD-2007-2724

Multiple cross-site scripting XSS vulnerabilities in Jetbox CMS allow remote attackers to inject arbitrary web script or HTML via the 1 path parameter to view/search/; or the 2 companyname, 3 country, 4 email, 5 firstname, 6 middlename, 7 required, 8 surname, or 9 title parameter to...

CVE-2007-2625

CVE-2007-2625 is an XSS vulnerability in All In One Control Panel (AIOCP) prior to 1.3.016. The flaw resides in shared/code/cp_authorization.php and allows remote attackers to inject arbitrary web script or HTML via unspecified parameters. The entry notes that details are from third-party sources...

CVE-2006-7196

Cross-site scripting (XSS) vulnerability in the calendar example (cal2.jsp) of Apache Tomcat affects 4.0.0–4.0.6, 4.1.0–4.1.31, 5.0.0–5.0.30, and 5.5.0–5.5.15. An attacker can inject arbitrary script via the time parameter to cal2.jsp (and possibly other vectors). This enables script execution in...

CVE-2007-2472

CVE-2007-2472 is an XSS vulnerability in Sendcard 3.4.1 and earlier, affecting sendcard.php where the form parameter can be exploited to inject arbitrary script/HTML. The description notes the vulnerability details come from third-party sources with unknown provenance. Connected documents confirm...

CVE-2007-2245

Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin before 2.10.1.0 allow remote attackers to inject arbitrary web script or HTML via 1 the fieldkey parameter to browseforeigners.php or 2 certain input to the PMAsanitize function...

Input validation

The imagecomments function in classes.php in MiniGal b13 allows remote attackers to inject arbitrary PHP code into a file in the thumbs/ directory via the input parameter. NOTE: some of these details are obtained from third party information...

CVE-2007-2145

The imagecomments function in classes.php in MiniGal b13 allows remote attackers to inject arbitrary PHP code into a file in the thumbs/ directory via the input parameter. NOTE: some of these details are obtained from third party information...

CVE-2007-2146

The imagecomments function in classes.php in MiniGal b13 allow remote attackers to inject arbitrary PHP code into a file in the thumbs/ directory via the 1 name or 2 email parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2007-2146

CVE-2007-2146 affects MiniGal b13: the imagecomments function in classes.php lets remote attackers inject arbitrary PHP code into a file under thumbs/ by supplying the name or email parameter. This is a client-controlled input vulnerability in a PHP application function, enabling code injection w...

ShoutPro <= 1.5.2 (shout.php) Remote Code Injection Exploit

No description provided by source. ?/ File: shoutbox.php Affects: ShoutPro 1.5.2 may affect earlier versions Date: 17th April 2007 Issue Description: =========================================================================== ShoutPro 1.5.2 fails to fully sanitize user input $shout that it writes...

CVE-2007-2093: Undefined Security Weakness

Direct static code injection vulnerability in index.php in Limesoft Guestbook LS Simple Guestbook 1.0 allows remote attackers to inject arbitrary PHP code into posts.txt via the message parameter...