CVE-2006-1702

CVE-2006-1702 affects SPIP 1.8.3 (spip_login.php3) where an attacker can trigger a remote file inclusion by supplying a URL in the url parameter, allowing arbitrary PHP code execution. This is documented in multiple sources showing the vulnerable component and vector (spip_login.php3, url paramet...

Vulnerabilities in SPIP

k k kkkk k kkkk k k kkkkkk kkkkkk kkkk k k k k k k k k k k k k k k kk k k k k kk k k k k kk kkkkk k kkkkk kk kk kkkkkk k k k k k k kk k k k k k k k kk k k k k k k k k k k k k kkkk k kkkk k k kk k k kkkk k kk k k k ------------------------------------------------------------------------------ =-...

SPIP 1.8.3 - Spip_login.php Remote File Inclusion

SPIP 1.8.3 - Spiplogin.php Remote File Inclusion source: https://www.securityfocus.com/bid/17423/info SPIP is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit this issue to include an...

SPIP 1.8.3 - 'Spip_login.php' Remote File Inclusion

source: https://www.securityfocus.com/bid/17423/info SPIP is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP co...

SPIP < 1.8.2-g Multiple SQLi and XSS Vulnerabilities

SPIP is prone to multiple SQL injection SQLi and cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2006 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CP...

SPIP < 1.8.2-g SQL Injection and XSS Flaws

The remote web server has a PHP application that is affected by multiple flaws. Description: The remote host is running SPIP, an open-source CMS written in PHP. The remote version of this software is prone to SQL injection and cross site scripting attacks. An attacker could send specially crafted...

DEBIAN-CVE-2006-1295

Cross-site scripting XSS vulnerability in recherche.php3 in SPIP 1.8.2-g allows remote attackers to inject arbitrary web script or HTML via the recherche parameter...

CVE-2006-1295

Cross-site scripting XSS vulnerability in recherche.php3 in SPIP 1.8.2-g allows remote attackers to inject arbitrary web script or HTML via the recherche parameter...

CVE-2006-1295

Cross-site scripting XSS vulnerability in recherche.php3 in SPIP 1.8.2-g allows remote attackers to inject arbitrary web script or HTML via the recherche parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in recherche.php3 in SPIP 1.8.2-g allows remote attackers to inject arbitrary web script or HTML via the recherche parameter...

CVE-2006-1295

Cross-site scripting XSS vulnerability in recherche.php3 in SPIP 1.8.2-g allows remote attackers to inject arbitrary web script or HTML via the recherche parameter...

CVE-2006-1295

CVE-2006-1295 affects SPIP 1.8.2-g with a Cross-site Scripting (XSS) vulnerability in recherche.php3, exploitable by supplying a crafted recherche parameter to inject arbitrary script/HTML. The provided sources consistently describe the flaw as an XSS in the search parameter, but do not include a...

CVE-2006-1295

Cross-site scripting XSS vulnerability in recherche.php3 in SPIP 1.8.2-g allows remote attackers to inject arbitrary web script or HTML via the recherche parameter...

SPIP < 1.8.2-g Multiple Vulnerabilities

The remote host is running SPIP, an open source CMS written in PHP. The remote version of this software is prone to SQL injection and cross-site scripting attacks. An attacker could send specially crafted URL to modify SQL requests, for example, to obtain the admin password hash, or execute...

CVE-2006-0625

Directory traversal vulnerability in SpipRSS.PHP in SPIP 1.8.2g and earlier allows remote attackers to read or include arbitrary files via ".." sequences in the GLOBALStypeurls parameter, which could then be used to execute arbitrary code via resultant direct static code injection in the file...

CVE-2006-0626

SQL injection vulnerability in spipaccesdoc.php3 in SPIP 1.8.2g and earlier allows remote attackers to execute arbitrary SQL commands via the file parameter...

Directory traversal

Directory traversal vulnerability in SpipRSS.PHP in SPIP 1.8.2g and earlier allows remote attackers to read or include arbitrary files via ".." sequences in the GLOBALStypeurls parameter, which could then be used to execute arbitrary code via resultant direct static code injection in the file...

Sql injection

SQL injection vulnerability in spipaccesdoc.php3 in SPIP 1.8.2g and earlier allows remote attackers to execute arbitrary SQL commands via the file parameter...

CVE-2006-0625

Directory traversal vulnerability in SpipRSS.PHP in SPIP 1.8.2g and earlier allows remote attackers to read or include arbitrary files via ".." sequences in the GLOBALStypeurls parameter, which could then be used to execute arbitrary code via resultant direct static code injection in the file...

CVE-2006-0626

SQL injection vulnerability in spipaccesdoc.php3 in SPIP 1.8.2g and earlier allows remote attackers to execute arbitrary SQL commands via the file parameter...