CVE-2008-3458

Vtiger CRM before 5.0.4 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read mail merge templates via a direct request to the wordtemplatedownload directory...

k-links directory - SQL Injection Cross-Site Scripting

k-links directory - SQL Injection Cross-Site Scripting ================================================================================ || K-Links Directory SQL-INJECTION, XSS ================================================================================ Application: K-Links Directory...

CodeDB 1.1.1 - 'list.php' Local File Inclusion

Name : CodeDB list.php lang Local File Inclusion Vulnerability Author : cOndemned Greetz : ZaBeaTy, str0ke, irk4z, GregStar, doctor, Adish, Avantura ; Source : // list.php 2. $lang = htmlspecialchars$GET'lang'; // ok, but.... for what ? lol 7. iffileexists'templates/'.$lang.'middle.php' // We'll...

CodeDB 1.1.1 - list.php Local File Inclusion

CodeDB 1.1.1 - list.php Local File Inclusion Name : CodeDB list.php lang Local File Inclusion Vulnerability Author : cOndemned Greetz : ZaBeaTy, str0ke, irk4z, GregStar, doctor, Adish, Avantura ; Source : // list.php 2. $lang = htmlspecialchars$GET'lang'; // ok, but.... for what ? lol 7...

CVE-2008-2981

PHP remote file inclusion vulnerability in admin/templates/templatethumbnail.php in HomePH Design 2.10 RC2, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the thumbtemplate parameter...

Remote file inclusion

PHP remote file inclusion vulnerability in admin/templates/templatethumbnail.php in HomePH Design 2.10 RC2, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the thumbtemplate parameter...

CVE-2008-2981

PHP remote file inclusion vulnerability in admin/templates/templatethumbnail.php in HomePH Design 2.10 RC2, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the thumbtemplate parameter...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in Contenido CMS 4.8.4 allow remote attackers to execute arbitrary PHP code via a URL in the 1 contenidopath parameter to a contenido/backendsearch.php; the 2 cfgpathcontenido parameter to b movearticles.php, c moveoldstats.php, d...

Blog PixelMotion - modif_config.php Arbitrary File Upload

Blog PixelMotion - modifconfig.php Arbitrary File Upload ------------------------------------------------------------------------- -- JIKI Team JIKO + KIl1er --- ------------------------------------------------------------------------- Author : jiko jiki team email : [email protected] Home :...

CVE-2008-1066

The modifier.regexreplace.php plugin in Smarty before 2.6.19, as used by Serendipity S9Y and other products, allows attackers to call arbitrary PHP functions via templates, related to a '\0' character in a search string...

CVE-2008-1066

The modifier.regexreplace.php plugin in Smarty before 2.6.19, as used by Serendipity S9Y and other products, allows attackers to call arbitrary PHP functions via templates, related to a '\0' character in a search string...

CVE-2008-1066

The modifier.regexreplace.php plugin in Smarty before 2.6.19, as used by Serendipity S9Y and other products, allows attackers to call arbitrary PHP functions via templates, related to a '\0' character in a search string...

Directory traversal

Multiple directory traversal vulnerabilities in PowerScripts PowerNews 2.5.6 allow remote attackers to read and include arbitrary files via a .. dot dot in the 1 subpage parameter in a categories.inc.php, b news.inc.php, c other.inc.php, d permissions.inc.php, e templates.inc.php, and f...

CVE-2008-0564

Multiple cross-site scripting XSS vulnerabilities in Mailman before 2.1.10b1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to 1 editing templates and 2 the list's "info attribute" in the web administrator interface, a different vulnerability than...

CVE-2008-0564

Multiple cross-site scripting XSS vulnerabilities in Mailman before 2.1.10b1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to 1 editing templates and 2 the list's "info attribute" in the web administrator interface, a different vulnerability than...

mailman -- script insertion vulnerability

Secunia reports: A vulnerability has been reported in Mailman, which can be exploited by malicious users to conduct script insertion attacks. Certain input when editing the list templates and the list info attribute is not properly sanitised before being stored. This can be exploited to insert...

CVE-2008-0231

Multiple directory traversal vulnerabilities in index.php in Tuned Studios 1 Subwoofer, 2 Freeze Theme, 3 Orange Cutout, 4 Lonely Maple, 5 Endless, 6 Classic Theme, and 7 Music Theme webpage templates allow remote attackers to include and execute arbitrary files via ".." sequences in the page...

Tuned Studios Templates Local File Inclusion Vulnerability

No description provided by source. Digital Security Research Group DSecRG Advisory DSECRG08-001 Application: Tuned Studios Templates Versions Affected: All Vendor URL: http:/www.tunedstudios.com Bug: Local File Include Exploits: YES Reported: 09.01.2008 Date of Public Advisory: 09.01.2008 Authors...

DSECRG08-001.txt

Digital Security Research Group DSecRG Advisory DSECRG08-001 Application: Tuned Studios Templates Versions Affected: All Vendor URL: http:/www.tunedstudios.com Bug: Local File Include Exploit: YES Reported: 09.01.2008 Date of Public Advisory: 09.01.2008 Authors: Alexandr Polyakov, Stas Svistunovi...

LFI in Tuned Studios Templates

Digital Security Research Group DSecRG Advisory DSECRG08-001 Application: Tuned Studios Templates Versions Affected: All Vendor URL: http:/www.tunedstudios.com Bug: Local File Include Exploit: YES Reported: 09.01.2008 Date of Public Advisory: 09.01.2008 Authors: Alexandr Polyakov, Stas Svistunovi...