Classmates 1.1.1 Cross Site Scripting

Product: CLASSMATES Vendor: http://www.got.my http://www.got.my/CLASSMATES/ Vulnerable Version: 1.1.1 Vulnerability Type: XSS Cross Site Scripting Risk level: Medium Credit: Hector.x90 Vulnerability Details: User can execute arbitrary JavaScript code within the vulnerable application. The...

CVE-2008-6659: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in Simple Machines Forum SMF 1.0 before 1.0.15 and 1.1 before 1.1.7 allows remote authenticated users to configure arbitrary local files for execution via directory traversal sequences in the value of the themedir field during a jsoption action,...

CVE-2008-3563

Multiple SQL injection vulnerabilities in Plogger 3.0 and earlier allow remote attackers to execute arbitrary SQL commands via 1 the checked array parameter to plog-download.php in an album action and 2 unspecified parameters to plog-remote.php, and 3 allow remote authenticated administrators to...

CVE-2004-1989: Undefined Security Weakness

PHP remote file inclusion vulnerability in theme.php in Coppermine Photo Gallery 1.2.2b allows remote attackers to execute arbitrary PHP code by modifying the THEMEDIR parameter to reference a URL on a remote web server that contains userlistinfobox.inc...