CVE-2007-3309

The CVE-2007-3309 entry concerns Simple Machines Forum (SMF) 1.1.2, where a vulnerability enables remote attackers to execute arbitrary PHP code during (1) message creation or (2) message editing. The available sources identify the affected software/version and the code-execution risk but do not ...

уязвимости smf 1.1.2

Simple Machines Forum 1.1.2 http://www.simplemachines.org/ 1 слабая реализация звуковой капчи в этом движке звуковая капча реализуется посредством посылания браузеру звукового фала в формате WAV, файл создается путем склеивания произвольным образом нескольких файлов с разными звуками, и служит...

CVE-2007-2546

CVE-2007-2546 affects Simple Machines Forum (SMF) versions up to 1.1.2. The vulnerability is a session fixation flaw that lets an attacker hijack a user’s web session by manipulating the PHPSESSID parameter. The connected documents corroborate the issue in SMF 1.1.2 and earlier, with related entr...

CVE-2007-2546

Session fixation vulnerability in Simple Machines Forum SMF 1.1.2 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID parameter...

eFiction 3.1.1 - path_to_smf Remote File Inclusion

eFiction 3.1.1 - pathtosmf Remote File Inclusion To ConTacT mE @ www.Asb-May.net/bb ScRiPt:-http://www.efiction.org/downloads/eFiction31.zip GrEaTz To:-ToOofa-HaCk.eGy All AsB-MaY DisCoverY ExPloIts GrOup Discovered By:- ThE dE@Th logout.php:- includeonce$pathtosmf."Sources/Subs-Auth.php";...

eFiction 3.1.1 - 'path_to_smf' Remote File Inclusion

To ConTacT mE @ www.Asb-May.net/bb ScRiPt:-http://www.efiction.org/downloads/eFiction31.zip GrEaTz To:-ToOofa-HaCk.eGy All AsB-MaY DisCoverY ExPloIts GrOup Discovered By:- ThE dE@Th logout.php:- includeonce$pathtosmf."Sources/Subs-Auth.php"; getsessionvars.php:- requireonce$pathtosmf."SSI.php";...

CVE-2006-7013

CVE-2006-7013 affects Simple Machines Forum (SMF) versions 1.0.7 and earlier and 1.1rc2 and earlier. The issue lets remote attackers spoof the user IP and evade bans by manipulating the X-Forwarded-For header, which is treated as the IP source instead of more reliable sources. The root cause is r...

CVE-2007-0399

Multiple cross-site scripting XSS vulnerabilities in index.php in Simple Machines Forum SMF 1.1 RC3 allow remote authenticated users to inject arbitrary web script or HTML via the 1 recipient or 2 BCC field when selecting send in a pm action...

CVE-2007-0399

SMF 1.1 RC3 exposes multiple XSS flaws in index.php during the PM “send” action. Infected input (recipient/BCC fields) can inject arbitrary script/HTML in the context of an authenticated user. Affected: Simple Machines Forum (SMF), version 1.1 RC3; vulnerability arises in the PM sending workflow....

CVE-2007-0399

Multiple cross-site scripting XSS vulnerabilities in index.php in Simple Machines Forum SMF 1.1 RC3 allow remote authenticated users to inject arbitrary web script or HTML via the 1 recipient or 2 BCC field when selecting send in a pm action...

SMF "index.php?action=pm" Cross Site-Scripting

Aria-Security Team http://Aria-Security.com Type:Remote Cross-Site Scripting Article on XSS: http://aria-security.net/xss.rar Discovered By Aria-Security Team Tested on SMF 1.1 RC3 Explanation: -First of all user must be REGISTERED -Go to http://target/smf/index.php?action=pm;sa=send -Inster your...

SMF 1.1 - index.php HTML Injection

SMF 1.1 - index.php HTML Injection source: https://www.securityfocus.com/bid/22143/info SMF is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script code would execute ...

SMF 1.1 - 'index.php' HTML Injection

source: https://www.securityfocus.com/bid/22143/info SMF is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script code would execute in the context of the affected...

CVE-2006-6375

Cross-site scripting XSS vulnerability in display.php in Simple Machines Forum SMF 1.1 Final and earlier allows remote attackers to inject arbitrary web script or HTML via the contents of a file that is uploaded with the image parameter set, which can be interpreted as script by Internet Explorer...

CVE-2006-6375

CVE-2006-6375 is a cross-site scripting (XSS) flaw in display.php of Simple Machines Forum (SMF) 1.1 Final and earlier. The vulnerability allows remote attackers to inject arbitrary script/HTML via the contents of a file uploaded with the image parameter, which can be interpreted as script by Int...

CVE-2006-5504

Cross-site scripting XSS vulnerability in index.php in Simple Machines Forum SMF allows remote attackers to inject arbitrary web script or HTML via a base64 encoded params value in the action parameter...

CVE-2006-5504

CVE-2006-5504 affects Simple Machines Forum (SMF). The vulnerability is a Cross-site Scripting (XSS) in index.php where an attacker can inject arbitrary web script or HTML by supplying a base64-encoded value in the action parameter. Impact is described as partial integrity impact on the target. T...

CVE-2006-5503

The provided data confirms a Cross-site scripting (XSS) vulnerability in Simple Machines Forum (SMF) 1.1 RC2 . The issue occurs in the file indicated by the description (likely index.php) where an attacker can inject arbitrary script/HTML via the action parameter , enabling remote script executio...

CVE-2006-5503

Cross-site scripting XSS vulnerability in index.php in Simple Machines Forum SMF 1.1 RC2 allows remote attackers to inject arbitrary web script or HTML via the action parameter...

CVE-2006-5504

Cross-site scripting XSS vulnerability in index.php in Simple Machines Forum SMF allows remote attackers to inject arbitrary web script or HTML via a base64 encoded params value in the action parameter...