CVE-2007-0372

Multiple SQL injection vulnerabilities in Francisco Burzi PHP-Nuke 7.9 allow remote attackers to execute arbitrary SQL commands via 1 the active parameter in admin/modules/modules.php; the 2 adclass, 3 imageurl, 4 clickurl, 5 adcode, or 6 position parameter in modules/Advertising/admin/index.php;...

CVE-2007-0372

Multiple SQL injection vulnerabilities in Francisco Burzi PHP-Nuke 7.9 allow remote attackers to execute arbitrary SQL commands via 1 the active parameter in admin/modules/modules.php; the 2 adclass, 3 imageurl, 4 clickurl, 5 adcode, or 6 position parameter in modules/Advertising/admin/index.php;...

CVE-2006-6074

Multiple SQL injection vulnerabilities in Enthrallweb eShopping Cart allow remote attackers to execute arbitrary SQL commands via 1 the ProductID parameter in a reviews.asp, or the 2 catid or 3 subid parameter in b subProducts.asp. NOTE: the productdetail.asp vector is already covered by another...

PT-2006-6719 · Enthrallweb · Enthrallweb Eshopping Cart

Name of the Vulnerable Software and Affected Versions: Enthrallweb eShopping Cart affected versions not specified Description: The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the ProductID parameter in the "reviews.asp" endpoint, or the cat id or sub ...

osCommerce 2.2 - '/admin/reviews.php?page' Cross-Site Scripting

source: https://www.securityfocus.com/bid/20343/info osCommerce is prone to multiple cross-site scripting vulnerabilities. An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attack...

PT-2006-3886 · Viart · Viart Shop

Name of the Vulnerable Software and Affected Versions: ViArt Shop Free version 2.5.5 Description: The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the forum id parameter in "forum.php", which is not properly handled in "block forum topics.php", an...

[NOBYTES.COM: #12] ViArt Shop v2.5.5 - XSS Vulnerability

ViArt Shop v2.5.5 Free and possibly Light, Standard, and Enterprise Authors Site: http://www.codetosell.com/ +-Examples:--------------------------------------------------+ XSS: /forum.php?forumid="scriptalert'XSS';/script&categoryid=1...

CVE-2006-2618

Cross-site scripting XSS vulnerability in 1 AlstraSoft Web Host Directory 1.2, aka 2 HyperStop WebHost Directory 1.2, might allow remote attackers to inject arbitrary web script or HTML via the "write a review" box. NOTE: since user reviews do not require administrator privileges, and an...

AlstraSoft Web Host Directory v1.2

AlstraSoft Web Host Directory v1.2 Homepage: http://www.alstrasoft.com/ It should be noted too that the demo for this script is on a different domain which also sells a WebHost Directory which looks to be the same product/company called HyperStop WebHost Directory 1.2. Both scripts seem to be the...

CVE-2006-0923

Multiple cross-site scripting XSS vulnerabilities in MyPHPNuke MPN 1.88 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the letter parameter in reviews.php and 2 the dcategory parameter in download.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in MyPHPNuke MPN 1.88 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the letter parameter in reviews.php and 2 the dcategory parameter in download.php...

Remember the Alma Mater of a non-marginalia attack-vulnerability warning-the black bar safety net

Editor's note: a very old article, The author has also not been released, I steal it out for everyone to draw on the following ideas． A． Causes. School of the FAI says he sent the on-campus DV reviews old deleted, so they want to test the forum security, then on the use side note got the...

CVE-2004-2296

CVE-2004-2296 affects the PHP-Nuke Reviews module (versions 6.0–7.3) where the preview_review function on Windows allows a remote attacker to obtain sensitive information by supplying an invalid date parameter, which triggers an error message. The vulnerability is described as a potential partial...

CVE-2004-2295

CVE-2004-2295 involves a SQL injection in the Reviews module of PHP-Nuke versions 6.0 through 7.3. The vulnerability allows remote attackers to execute arbitrary SQL commands by manipulating the order parameter, enabling potential data disclosure or modification. The provided documents identify t...

CVE-2004-2294

CVE-2004-2294 affects PHP-Nuke 6.0 through 7.3, where the send_review function in the Reviews module has a canonicalize-before-filter error. Text parameter processing allows remote attackers to inject arbitrary web script or HTML via hex-encoded XSS sequences after the text is checked for dangero...

CVE-2004-2297

The Reviews module in PHP-Nuke 6.0 to 7.3 allows remote attackers to cause a denial of service CPU and memory consumption via a large, out-of-range score parameter...

CVE-2004-2295

SQL injection vulnerability in the Reviews module in PHP-Nuke 6.0 to 7.3 allows remote attackers to execute arbitrary SQL commands via the order parameter...

CVE-2004-2293

PHP-Nuke 6.0–7.3 is affected by multiple XSS flaws in the Encyclopedia module (via the eid parameter or the module query), in Reviews module via the preview_review function (parameters: url, cover, rlanguage, hits), and in Reviews via savecomment (uname parameter). Root cause: improper handling o...

CVE-2004-2296

The previewreview function in the Reviews module in PHP-Nuke 6.0 to 7.3, when running on Windows systems, allows remote attackers to obtain sensitive information via an invalid date parameter, which generates an error message...

CVE-2004-2297

The CVE-2004-2297 case concerns the Reviews module of PHP-Nuke versions 6.0 through 7.3. The vulnerability is a denial of service caused by a large, out-of-range score parameter that can consume CPU and memory. The available sources (NVD, CVE lists) describe the impact as a CPU/memory DoS but do ...