Cross site scripting

Cross-site scripting XSS vulnerability in search.php in MyBB aka MyBulletinBoard 1.0.2 allows remote attackers with knowledge of the table prefix to inject arbitrary web script or HTML via a URL encoded value of the keywords parameter, as demonstrated by %3Cscript%3E...

CVE-2006-0639

CVE-2006-0639 : A cross-site scripting (XSS) vulnerability in MyBB 1.0.2 affects search.php where the keywords parameter is not properly sanitized, allowing a remote attacker with knowledge of the table prefix to inject arbitrary script/HTML via a URL-encoded payload (e.g., %3Cscript%3E). Affecte...

Sql injection

SQL injection vulnerability in search.php in MyTopix 1.2.3 allows remote attackers to execute arbitrary SQL commands via the 1 mid and 2 keywords parameters...

CVE-2006-0588

SQL injection vulnerability in search.php in MyTopix 1.2.3 allows remote attackers to execute arbitrary SQL commands via the 1 mid and 2 keywords parameters...

CVE-2006-0588

SQL injection vulnerability in search.php in MyTopix 1.2.3 allows remote attackers to execute arbitrary SQL commands via the 1 mid and 2 keywords parameters...

[myimei]MyBB 1.0.2 XSS attack in search.php

original advisory: http://myimei.com/security/2006-01-14-mybb-102searchphpxss-attackandmore/index.html --------------- —————-Summary—————- Software: MyBB Sowtware’s Web Site: http://mybboard.com Versions: 1.0.2 Class: Remote Status: patched in 1.0.3 Exploit: Available Solution: Available Discover...

Cross site scripting

Cross-site scripting XSS vulnerability in search.php in MyBulletinBoard MyBB 1.02 allows remote attackers to inject arbitrary web script or HTML via the 1 sortby and 2 sortordr parameters, which are not properly handled in a redirection...

CVE-2006-0470

CVE-2006-0470 describes an XSS vulnerability in MyBB 1.02’s search.php where the sortby and sortordr parameters are not properly handled during redirection. An attacker could inject arbitrary script/HTML by manipulating these parameters, leading to possible remote script execution in the context ...

Code injection

phpBB 2.0.19 and earlier allows remote attackers to cause a denial of service application crash by 1 registering many users through profile.php or 2 using search.php to search in a certain way that confuses the database...

CVE-2006-0450

phpBB 2.0.19 and earlier allows remote attackers to cause a denial of service application crash by 1 registering many users through profile.php or 2 using search.php to search in a certain way that confuses the database...

MyBB 1.0.2 XSS attack in search.php redirection

http://127.0.0.1/mybb/search.php?action=dosearch&keywords=&postthread=1&author=imei&matchusername=1&forums=all&findthreadst=1&numreplies=&postdate=0&pddir=1&sortby="script language=javascriptalertdocument.cookie/script&sorder=1&showresults=threads&submit=Search...

CVE-2006-0406

search.php in MyBB 1.0.2 allows remote attackers to obtain sensitive information via a certain search request that reveals the table prefix in a SQL error message, possibly due to invalid parameters...

CVE-2006-0406

CVE-2006-0406 affects MyBB 1.0.2: the search.php component can leak schema details by returning a SQL error message that reveals the database table prefix, due to certain search parameters. This is a remote-information-disclosure risk without explicit exploitation details in the provided document...

Sql injection

Multiple SQL injection vulnerabilities in SaralBlog 1.0 allow remote attackers to execute arbitrary SQL commands via the search parameter to search.php. NOTE: the id/viewprofile.php issue is already covered by CVE-2005-4058...

CVE-2006-0334

Cross-site scripting XSS vulnerability in search.php in My Amazon Store Manager 1.0 allows remote attackers to inject arbitrary web script or HTML via the Keywords parameter. NOTE: some sources claim that the affected parameter is "q", but the only public archive of the original researcher...

dcpXSS.txt

NightWarrior nightwarrior771athotmail.com DCP Portal Cross-Site Scripting Vulnerability http://www.dcp-portal.org http://vicktimhost/calendar.php?show=fullmonth&s=1&submit=GO&day=XSS http://vicktimhost/search.php post this code alert'nightwarrior';...

CVE-2006-0334

CVE-2006-0334 describes a reflected cross-site scripting (XSS) vulnerability in the search.php of My Amazon Store Manager 1.0. The issue enables an attacker to inject arbitrary web script or HTML by supplying crafted input via the Keywords parameter (note: some sources reference parameter q, but ...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in sBLOG 0.7.1 Beta 20051202 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 p and 2 keyword parameters in a index.php and b search.php...

CVE-2006-0101

Multiple cross-site scripting XSS vulnerabilities in sBLOG 0.7.1 Beta 20051202 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 p and 2 keyword parameters in a index.php and b search.php...

CVE-2006-0101

Multiple cross-site scripting XSS vulnerabilities in sBLOG 0.7.1 Beta 20051202 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 p and 2 keyword parameters in a index.php and b search.php...