3500 matches found
wppersist-xss.txt
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 1. DESCRIPTION OF THE SOFTWARE On May 6th, 2007 a new WordPress plugin called "stats" was released. This plugin allows a WordPress user who has his blog self-hosted to use the Wordpress.com statistics. The plugin includes a JavaScript on the blog page...
WordPress Automattic Stats Plugin <= 1.0 - XSS
Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the HTTP Referer field. Solution Update the plugin...
CVE-2007-3288: Undefined Security Weakness
Cross-site scripting XSS vulnerability in the skeltoac stats Automattic Stats 1.0 plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer field...
CVE-2007-2716
Multiple cross-site scripting XSS vulnerabilities in EQdkp 1.3.2c and earlier allow remote attackers to inject arbitrary web script or HTML via the show parameter to 1 listmembers.php and 2 stats.php. NOTE: some of these details are obtained from third party information...
CVE-2007-1871: Undefined Security Weakness
Cross-site scripting XSS vulnerability in chcounter 3.1.3 allows remote attackers to inject arbitrary web script or HTML via the loginname parameter to /stats/...
CVE-2006-7172
Multiple SQL injection vulnerabilities in php-stats.recphp.php in PHP-Stats 0.1.9.1b and earlier allow remote attackers to execute arbitrary code via a leading dotted-quad IP address string in the 1 PC-REMOTE-ADDR HTTP header, which is inserted into $SERVER'HTTPPCREMOTEADDR', or 2 ip parameter...
CVE-2006-7173
Direct static code injection vulnerability in admin.php in PHP-Stats 0.1.9.1b and earlier allows remote attackers to execute arbitrary PHP code via a crafted optionnewreportwday parameter in a preferenze action, which can be later accessed via option/php-stats-options.php...
CVE-2006-7172
CVE-2006-7172 affects PHP-Stats up to version 0.1.9.1b. Multiple SQL injection flaws exist in php-stats.recphp.php that allow remote attackers to execute arbitrary code via the (1) PC-REMOTE-ADDR HTTP header (in $_SERVER['HTTP_PC_REMOTE_ADDR']) or (2) ip parameter. The header infers a leading dot...
CVE-2006-7173
Direct static code injection vulnerability in admin.php in PHP-Stats 0.1.9.1b and earlier allows remote attackers to execute arbitrary PHP code via a crafted optionnewreportwday parameter in a preferenze action, which can be later accessed via option/php-stats-options.php...
CVE-2006-7173
CVE-2006-7173 affects PHP-Stats prior to 0.1.9.1b. Description: direct static code injection in admin.php allows remote PHP code execution via crafted option_new[report_w_day] in a preferenze action, which can later be accessed through option/php-stats-options.php. NVD assigns a HIGH base score (...
CVE-2006-7172
Multiple SQL injection vulnerabilities in php-stats.recphp.php in PHP-Stats 0.1.9.1b and earlier allow remote attackers to execute arbitrary code via a leading dotted-quad IP address string in the 1 PC-REMOTE-ADDR HTTP header, which is inserted into $SERVER'HTTPPCREMOTEADDR', or 2 ip parameter...
CVE-2006-7173: Undefined Security Weakness
Direct static code injection vulnerability in admin.php in PHP-Stats 0.1.9.1b and earlier allows remote attackers to execute arbitrary PHP code via a crafted optionnewreportwday parameter in a preferenze action, which can be later accessed via option/php-stats-options.php...
CVE-2006-7172: Undefined Security Weakness
Multiple SQL injection vulnerabilities in php-stats.recphp.php in PHP-Stats 0.1.9.1b and earlier allow remote attackers to execute arbitrary code via a leading dotted-quad IP address string in the 1 PC-REMOTE-ADDR HTTP header, which is inserted into $SERVER'HTTPPCREMOTEADDR', or 2 ip parameter...
Php-Stats <= 0.1.9.1b (php-stats-options.php) admin 2 exec() eExploit
No description provided by source. ?php printr' --------------------------------------------------------------------------- Php-Stats = 0.1.9.1b admin 2 exec exploit by rgod mail: retrog at alice dot it site: http://retrogod.altervista.org dork example: inurl:php-stats.js.php...
PHP-Stats 0.1.9.1b - PHP-stats-options.php Command Execution
PHP-Stats 0.1.9.1b - PHP-stats-options.php Command Execution ?php printr' --------------------------------------------------------------------------- Php-Stats = 0.1.9.1b admin 2 exec exploit by rgod mail: retrog at alice dot it site: http://retrogod.altervista.org dork example:...
Php-Stats <= 0.1.9.1b (PC-REMOTE-ADDR) SQL Injection Exploit
No description provided by source. ?php printr' --------------------------------------------------------------------------- Php-Stats = 0.1.9.1b PC-REMOTE-ADDR sql injection / cleat text admin pass disclosure by rgod mail: retrog at alice dot it site: http://retrogod.altervista.org...
PHP-Stats 0.1.9.1b - 'PHP-stats-options.php' Command Execution
126 $result.=" ."; else $result.=" ".$s...
Php-Stats <= 0.1.9.1b (ip) Remote SQL Injection Exploit
No description provided by source. ?php printr' --------------------------------------------------------------------------- Php-Stats = 0.1.9.1b "ip" urldecode/ ereg / sql injection / cleat text admin pass disclosure exploit method ii by rgod mail: retrog at alice dot it site:...
Php-Stats <= 0.1.9.1b (php-stats-options.php) admin 2 exec() eExploit
Exploit for unknown platform in category web applications ===================================================================== Php-Stats = 0.1.9.1b php-stats-options.php admin 2 exec eExploit ===================================================================== ?php printr'...
Php-Stats <= 0.1.9.1b (PC-REMOTE-ADDR) SQL Injection Exploit
No description provided by source. ?php printr' --------------------------------------------------------------------------- Php-Stats = 0.1.9.1b PC-REMOTE-ADDR sql injection / cleat text admin pass disclosure by rgod mail: retrog at alice dot it site: http://retrogod.altervista.org...