sBLOG search.php keyword Parameter SQL Injection

The remote host is running sBLOG, a PHP-based blog application. The installed version of sBLOG fails to validate user input to the 'keyword' parameter of the 'search.php' script before using it to generate database queries. Regardless of PHP's 'magicquotesgpc' setting, an unauthenticated attacker...

CVE-2006-2128: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Pro Publish 2.0 allow remote attackers to execute arbitrary SQL commands via the 1 email and 2 password parameter to a admin/login.php, 3 findstr parameter to b search.php, or 4 artid parameter to c art.php, or 5 catid parameter to d cat.php...

CVE-2006-2059

actionpublic/search.php in Invision Power Board IPB 2.1.x and 2.0.x before 20060425 allows remote attackers to execute arbitrary PHP code via a search with a crafted value of the lastdate parameter, which alters the behavior of a regular expression to add a "e" execute modifier...

CVE-2006-2059: Undefined Security Weakness

actionpublic/search.php in Invision Power Board IPB 2.1.x and 2.0.x before 20060425 allows remote attackers to execute arbitrary PHP code via a search with a crafted value of the lastdate parameter, which alters the behavior of a regular expression to add a "e" execute modifier...

CVE-2006-2016

Multiple cross-site scripting XSS vulnerabilities in phpLDAPadmin 0.9.8 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 dn parameter in a compareform.php, b copyform.php, c renameform.php, d templateengine.php, and e deleteform.php; 2 scope parameter in f...

CVE-2006-2016

Multiple cross-site scripting XSS vulnerabilities in phpLDAPadmin 0.9.8 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 dn parameter in a compareform.php, b copyform.php, c renameform.php, d templateengine.php, and e deleteform.php; 2 scope parameter in f...

CVE-2006-2016

Multiple cross-site scripting XSS vulnerabilities in phpLDAPadmin 0.9.8 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 dn parameter in a compareform.php, b copyform.php, c renameform.php, d templateengine.php, and e deleteform.php; 2 scope parameter in f...

CVE-2006-2016: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in phpLDAPadmin 0.9.8 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 dn parameter in a compareform.php, b copyform.php, c renameform.php, d templateengine.php, and e deleteform.php; 2 scope parameter in f...

CVE-2006-1841

Cross-site scripting XSS vulnerability in search.php in boastMachine bMachine 2.7, and possibly other versions before 2.9b, allows remote attackers to inject arbitrary web script or HTML via the key parameter, as used by the search field...

CVE-2006-1841

CVE-2006-1841 : A persistent XSS vulnerability exists in the search.php module of boastMachine (bMachine) 2.7, and possibly earlier versions before 2.9b. The flaw allows remote attackers to inject arbitrary web script or HTML via the key parameter used by the search field. The available documents...

CVE-2006-1841

Cross-site scripting XSS vulnerability in search.php in boastMachine bMachine 2.7, and possibly other versions before 2.9b, allows remote attackers to inject arbitrary web script or HTML via the key parameter, as used by the search field...

CVE-2006-1841: Undefined Security Weakness

Cross-site scripting XSS vulnerability in search.php in boastMachine bMachine 2.7, and possibly other versions before 2.9b, allows remote attackers to inject arbitrary web script or HTML via the key parameter, as used by the search field...

CVE-2006-1822

Cross-site scripting XSS vulnerability in search.php in FarsiNews 2.5.3 Pro and earlier allows remote attackers to inject arbitrary web script or HTML via the selectedsearcharch parameter...

CVE-2006-1822

CVE-2006-1822 describes a cross-site scripting (XSS) flaw in the search.php component of FarsiNews 2.5.3 Pro and earlier. The vulnerability occurs when handling the selected_search_arch parameter, allowing remote attackers to inject arbitrary web script or HTML that could execute in a victim’s br...

CVE-2006-1822: Undefined Security Weakness

Cross-site scripting XSS vulnerability in search.php in FarsiNews 2.5.3 Pro and earlier allows remote attackers to inject arbitrary web script or HTML via the selectedsearcharch parameter...

CVE-2006-1720

Cross-site scripting XSS vulnerability in search.php in SaphpLesson 3.0 allows remote attackers to inject arbitrary web script or HTML via the Word parameter. NOTE: it is possible that this issue is resultant from SQL injection...

CVE-2006-1720

SaphpLesson 3.0 is affected by an XSS in search.php via the Word parameter. The issue may stem from SQL injection, per the CVE description. Detailing: vulnerable component is search.php (Word param in SaphpLesson 3.0), root cause is unsanitized input leading to script/HTML injection. Impact per s...

CVE-2006-1720

Cross-site scripting XSS vulnerability in search.php in SaphpLesson 3.0 allows remote attackers to inject arbitrary web script or HTML via the Word parameter. NOTE: it is possible that this issue is resultant from SQL injection...

CVE-2006-1720: Undefined Security Weakness

Cross-site scripting XSS vulnerability in search.php in SaphpLesson 3.0 allows remote attackers to inject arbitrary web script or HTML via the Word parameter. NOTE: it is possible that this issue is resultant from SQL injection...

CVE-2006-1674: Undefined Security Weakness

Cross-site scripting XSS vulnerability in search.php in PHPWebGallery 1.4.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter, a different vulnerability than CVE-2006-1675...