Directory traversal

Directory traversal vulnerability in runCMS 1.2 and earlier allows remote attackers to read arbitrary files via the bbPathpath parameter to 1 class.forumposts.php and 2 forumpollrenderer.php. NOTE: this issue is closely related to CVE-2006-0659...

CVE-2006-1793

RunCMS 1.2 and earlier are affected by a directory traversal vulnerability in the bbPath[path] parameter of class.forumposts.php and forumpollrenderer.php, enabling remote attackers to read arbitrary files. Root cause is improper handling of the bbPath[path] input leading to traversal. No remedia...

CVE-2006-1793

Directory traversal vulnerability in runCMS 1.2 and earlier allows remote attackers to read arbitrary files via the bbPathpath parameter to 1 class.forumposts.php and 2 forumpollrenderer.php. NOTE: this issue is closely related to CVE-2006-0659...

CVE-2006-1793: Undefined Security Weakness

Directory traversal vulnerability in runCMS 1.2 and earlier allows remote attackers to read arbitrary files via the bbPathpath parameter to 1 class.forumposts.php and 2 forumpollrenderer.php. NOTE: this issue is closely related to CVE-2006-0659...

Cross site scripting

Cross-site scripting XSS vulnerability in bigshow.php in Runcms 1.x allows remote attackers to inject arbitrary web script or HTML via the id parameter...

CVE-2006-1216

Cross-site scripting XSS vulnerability in bigshow.php in Runcms 1.x allows remote attackers to inject arbitrary web script or HTML via the id parameter...

CVE-2006-1216

CVE-2006-1216 affects Runcms 1.x, with an XSS vulnerability in bigshow.php exploitable via the id parameter. The issue allows remote attackers to inject arbitrary web script or HTML. The NVD entry lists a MEDIUM severity (CVSS v2: AV:N/AC:M/Au:N/C:N/I:P/A:N; base score 4.3), reflecting client-sid...

CVE-2006-1216

Cross-site scripting XSS vulnerability in bigshow.php in Runcms 1.x allows remote attackers to inject arbitrary web script or HTML via the id parameter...

CVE-2006-1216: Undefined Security Weakness

Cross-site scripting XSS vulnerability in bigshow.php in Runcms 1.x allows remote attackers to inject arbitrary web script or HTML via the id parameter...

runcms1xXSS.txt

KAPDA::31 - Runcms 1.x CrossSiteScripting vulnerability in bigshow.php KAPDA New advisory Vulnerable products : Runcms 1.x Vendor: www.runcms.org Risk: Low Vulnerabilities: CrossSiteScripting Discoverd by Roozbeh Afrasiabi roozbehatyahoodotcom www.kapda.ir www.persiax.com Date :...

RunCMS 1.x - Bigshow.php Cross-Site Scripting

RunCMS 1.x - Bigshow.php Cross-Site Scripting source: https://www.securityfocus.com/bid/16970/info RunCMS is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before including it in dynamically generated HTML...

[KAPDA::#31] - Runcms 1.x Cross_Site_Scripting vulnerability in bigshow.php

KAPDA::31 - Runcms 1.x CrossSiteScripting vulnerability in bigshow.php KAPDA New advisory Vulnerable products : Runcms 1.x Vendor: www.runcms.org Risk: Low Vulnerabilities: CrossSiteScripting Discoverd by Roozbeh Afrasiabi roozbehatyahoodotcom www.kapda.ir www.persiax.com Date :...

RunCMS 1.x - 'Bigshow.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/16970/info RunCMS is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before including it in dynamically generated HTML content. An attacker may leverage this issue t...

CVE-2006-0921

CVE-2006-0921 involves multiple directory traversal vulnerabilities in connector.php of FCKeditor 2.0 FC, used in products such as RunCMS. The issue allows remote attackers to list and create arbitrary directories by sending a .. payload in the CurrentFolder parameter to GetFoldersAndFiles and Cr...

phpRPC Library rpc_decoder.php decode() Function Arbitrary Code Execution

The remote host has installed on it the phpRPC library, an xmlrpc library written in PHP and bundled with applications such as RunCMS and exoops. The version of phpRPC on the remote host fails to sanitize user input to the 'server.php' script before using it in an 'eval' function, which may allow...

CVE-2006-0921: Undefined Security Weakness

Multiple directory traversal vulnerabilities in connector.php in FCKeditor 2.0 FC, as used in products such as RunCMS, allow remote attackers to list and create arbitrary directories via a .. dot dot in the CurrentFolder parameter to 1 GetFoldersAndFiles and 2 CreateFolder...

runcmsXSS.txt

KAPDA::27 - Runcms 1.x CrossSiteScripting vulnerability KAPDA New advisory Vulnerable products : Runcms 1.x Vendor: www.runcms.org Risk: Low Vulnerabilities: CrossSiteScripting Discoverd by Roozbeh Afrasiabi roozbehatyahoodotcom www.kapda.ir www.persiax.com Date : -------------------- Found : Jan...

Cross site scripting

Cross-site scripting vulnerability in ratefile.php in RunCMS 1.3a5 allows remote attackers to inject arbitrary web script or HTML via the lid parameter...

CVE-2006-0875

Cross-site scripting vulnerability in ratefile.php in RunCMS 1.3a5 allows remote attackers to inject arbitrary web script or HTML via the lid parameter...

CVE-2006-0875

RunCMS 1.3a5 is affected by a cross-site scripting vulnerability in ratefile.php that allows remote attackers to inject arbitrary script or HTML via the lid parameter. Affected component: ratefile.php in RunCMS 1.3a5. Root cause: input handling leads to XSS. Impact: potential script execution in ...