Unfixed XSS vulnerability at www.autozvuk.kiev.ua

Security researcher Xylitol, has submitted on 05/04/2009 a cross-site-scripting XSS vulnerability affecting www.autozvuk.kiev.ua, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 21/11/2011. It is current...

Cross site scripting

Cross-site scripting XSS vulnerability in refbase before 0.9.5 allows remote attackers to inject arbitrary web script or HTML via the headerMsg parameter to 1 show.php and 2 search.php. NOTE: some of these details are obtained from third party information...

CVE-2008-6400

The connected records confirm CVE-2008-6400 is a Cross-site Scripting (XSS) vulnerability in refbase up to version 0.9.4/0.9.5 (before 0.9.5). The issue arises via the headerMsg parameter used by show.php and search.php , allowing remote attackers to inject arbitrary web script/HTML. The root cau...

CVE-2008-6400: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in refbase before 0.9.5 allows remote attackers to inject arbitrary web script or HTML via the headerMsg parameter to 1 show.php and 2 search.php. NOTE: some of these details are obtained from third party information...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Camera Life 2.6.2b8 allow remote attackers to inject arbitrary web script or HTML via the q parameter to 1 search.php and 2 rss.php; the query string after the image name in 3 photos/photo; the path parameter to 4 folder.php; page parameter and...

CVE-2008-6295: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Camera Life 2.6.2b8 allow remote attackers to inject arbitrary web script or HTML via the q parameter to 1 search.php and 2 rss.php; the query string after the image name in 3 photos/photo; the path parameter to 4 folder.php; page parameter and...

Sql injection

SQL injection vulnerability in search.php in WSN Guest 1.23 allows remote attackers to execute arbitrary SQL commands via the search parameter in an advanced action...

CVE-2009-0704: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in search.php in WSN Guest 1.23 allows remote attackers to execute arbitrary SQL commands via the search parameter in an advanced action...

Directory traversal

Directory traversal vulnerability in search.php in miniPortail 2.2 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the lng parameter...

CVE-2008-6168: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in search.php in miniPortail 2.2 and earlier allows remote attackers to inject arbitrary web script or HTML via an unspecified argument, probably the search string...

CVE-2008-6167: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in search.php in miniPortail 2.2 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the lng parameter...

CVE-2008-6029: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in search.php in BuzzyWall 1.3.1 and earlier, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the search parameter...

CVE-2008-6015

CVE-2008-6015 relates to multiple SQL injection vulnerabilities in EsFaq 2.0 (search.php). The issues allow remote attackers to inject arbitrary SQL through the keywords and cat parameters. Affected component is the search functionality in EsFaq 2.0; root cause is improper input handling leading ...

CVE-2008-6015: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in search.php in EsFaq 2.0 allow remote attackers to execute arbitrary SQL commands via the 1 keywords and 2 cat parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-6004

Cross-site scripting XSS vulnerability in search.php in AJ Auction Pro Platinum 2 allows remote attackers to inject arbitrary web script or HTML via the product parameter...

CVE-2008-6004

Cross-site scripting XSS vulnerability in search.php in AJ Auction Pro Platinum 2 allows remote attackers to inject arbitrary web script or HTML via the product parameter...

CVE-2008-6004

CVE-2008-6004 is a Cross-site scripting (XSS) vulnerability affecting AJ Auction Pro Platinum 2, specifically in search.php via the product parameter. The NVD entry describes an attacker injecting arbitrary script/HTML, with a CVSSv2 base score of 4.3 (Medium) and vector: AV:N/AC:M/Au:N/C:N/I:P/A...

CVE-2008-6004: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in search.php in AJ Auction Pro Platinum 2 allows remote attackers to inject arbitrary web script or HTML via the product parameter...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in WB News 2.0.1, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the configinstalldir parameter to 1 search.php, 2 archive.php, 3 comments.php, and 4 news.php; 5 News.php, 6 SendFriend.php, 7...

WSN Guest 1.23 SQL Injection

WSN Guest 1.23 search.php SQL Injection Vulnerability %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% Author : DaiMon Homepage : http://www.cwdaimon.com Contact : cwdaimonatgmail.com...