2324 matches found
CVE-2009-4249
Multiple cross-site scripting XSS vulnerabilities in CutePHP CuteNews 1.4.6, when registerglobals is enabled and magicquotesgpc is disabled, allow remote attackers to inject arbitrary web script or HTML via the 1 lastusername and 2 mod parameters to index.php; and 3 the title parameter to...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allow remote attackers to inject arbitrary web script or HTML via 1 the result parameter to register.php; 2 the user parameter to search.php; the 3 catmsg, 4 sourcemsg, 5 postponedselected, 6...
CVE-2009-4249: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in CutePHP CuteNews 1.4.6, when registerglobals is enabled and magicquotesgpc is disabled, allow remote attackers to inject arbitrary web script or HTML via the 1 lastusername and 2 mod parameters to index.php; and 3 the title parameter to...
CVE-2009-4250
Multiple cross-site scripting XSS vulnerabilities in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allow remote attackers to inject arbitrary web script or HTML via 1 the result parameter to register.php; 2 the user parameter to search.php; the 3 catmsg, 4 sourcemsg, 5 postponedselected, 6...
CVE-2009-4266: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in search.php in YABSoft Advanced Image Hosting AIH Script 2.2, and possibly 2.3, allows remote attackers to inject arbitrary web script or HTML via the text parameter...
CVE-2009-4175: Exposure of Sensitive Information to an Unauthorized Actor
CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allows remote attackers to obtain sensitive information via an invalid date value in the fromdateday parameter to search.php, which reveals the installation path in an error message...
phpMyFAQ GET Variable Cross-Site-Scripting Vulnerability
This host is installed with phpMyFAQ and is prone to Cross Site Scripting vulnerability. OpenVAS Vulnerability Test $Id: secpodphpmyfaqgetxssvuln.nasl 5122 2017-01-27 12:16:00Z teissa $ phpMyFAQ GET Variable Cross-Site-Scripting Vulnerability Authors: Nikita MR Copyright: Copyright c 2009 SecPod,...
CuteNews 1.4.6 - 'from_date_day' Full Path Disclosure
source: https://www.securityfocus.com/bid/36971/info CuteNews and UTF-8 CuteNews are prone to multiple vulnerabilities, including cross-site scripting, HTML-injection, information-disclosure, arbitrary-script-injection, and security-bypass issues. Note that exploits for some of the issues may...
Unfixed XSS vulnerability at www.spelratter.se
Security researcher l0bster, has submitted on 30/09/2009 a cross-site-scripting XSS vulnerability affecting www.spelratter.se, which at the time of submission ranked 16754876 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 28/11/2011. It is...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in Datemill 1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 return parameter to photoview.php, and st parameter to 2 photosearch.php and 3 search.php...
CVE-2009-3360
Datemill 1.0 is affected by multiple XSS vulnerabilities. The issues arise from unsafely reflected input in the return parameter to photo_view.php and the st parameter to photo_search.php and search.php, enabling remote script injection. No explicit remediation or patch details are provided in th...
CVE-2009-3360
Multiple cross-site scripting XSS vulnerabilities in Datemill 1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 return parameter to photoview.php, and st parameter to 2 photosearch.php and 3 search.php...
CVE-2009-3360: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in Datemill 1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 return parameter to photoview.php, and st parameter to 2 photosearch.php and 3 search.php...
CVE-2009-3327
Multiple SQL injection vulnerabilities in WX-Guestbook 1.1.208 allow remote attackers to execute arbitrary SQL commands via the 1 QUERY parameter to search.php and 2 USERNAME parameter to login.php. NOTE: some of these details are obtained from third party information...
CVE-2009-3327: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL injection vulnerabilities in WX-Guestbook 1.1.208 allow remote attackers to execute arbitrary SQL commands via the 1 QUERY parameter to search.php and 2 USERNAME parameter to login.php. NOTE: some of these details are obtained from third party information...
WX Guestbook 1.1.208 SQLi and persistent XSS
No description provided by source. WX Guest Book 1.1.208 Vulns By learn3r hacker from nepal [email protected] Product name: WX Guestbook 1.1.208 Product vendor: www.webilix.com This product suffers from multiple SQLi and persistent XSS vuln. SQL Search Vuln The search parameters/queries w...
MyBB 1.4.8 SQL Injection
mybb v1.4.8 search.php blind/query based sql injection vulns author: $qLDoCt0r msn: [email protected] blog: http://full-discl0sure.blogspot.com moderator of: http://hackwarez.net search.php fails to correctly sanitise the user input validation allowing error based and query based sql...
CVE-2009-3202
Cross-site scripting XSS vulnerability in search.php in ULoKI PHP Forum 2.1 allows remote attackers to inject arbitrary web script or HTML via the term parameter...
CVE-2009-3202: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in search.php in ULoKI PHP Forum 2.1 allows remote attackers to inject arbitrary web script or HTML via the term parameter...
CVE-2009-3197
CVE-2009-3197 describes a cross-site scripting (XSS) vulnerability in the PHP Calendars Script by JCE-Tech, specifically in search.php. The flaw lets remote attackers inject arbitrary web script or HTML by supplying a crafted value to the search parameter. The NVD metrics indicate a MEDIUM-severi...