89 matches found
Design/Logic Flaw
Open Business Management OBM 2.4.0-rc13 and earlier allows remote attackers to obtain configuration information via a direct request to test.php, which calls the phpinfo function...
CVE-2011-5144
Open Business Management (OBM) server vulnerability CVE-2011-5144 affects OBM 2.4.0-rc13 and earlier. A direct request to test.php triggers phpinfo(), allowing remote attackers to obtain configuration information, i.e., partial disclosure of sensitive data. This is a server-side information discl...
CVE-2011-5144: Undefined Security Weakness
Open Business Management OBM 2.4.0-rc13 and earlier allows remote attackers to obtain configuration information via a direct request to test.php, which calls the phpinfo function...
CVE-2011-4950: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in phpgwapi/js/jscalendar/test.php in EGroupware Enterprise Line EPL before 11.1.20110804-1 and EGroupware Community Edition before 1.8.001.20110805 allows remote attackers to inject arbitrary web script or HTML via the lang parameter...
Open Journal Systems (OJS) 2.3.6 - Multiple Script Arbitrary File Upload
Open Journal Systems OJS 2.3.6 - Multiple Script Arbitrary File Upload source: https://www.securityfocus.com/bid/52666/info Open Journal Systems is prone to following multiple vulnerabilities because the software fails to sufficiently sanitize user-supplied input: 1. An arbitrary-file-deletion...
CVE-2011-3749
ka-Map 1.0-20070205 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by test.php and certain other files...
MyCommunity <= V1.02 Remote Code Execution
Exploit for php platform in category web applications ========================================== MyCommunity = V1.02 Remote Code Execution ==========================================...
视频播客SupeV 1.0.1 多个安全漏洞
SupeV 是discuz旗下视频播客产品。 漏洞文件：api目录下test.php 直接看代码 $str=filegetcontents $thumb ;//首先第18行用filegetcontents 读取$thumb参数的文件内容，注意这里也可以读远程文件， $path = ".".getthumbpath $vid ;//第19行获取路径参数 $vid $optbig = array "targetfile" = $path.".jpg", "attach" = $attach'attach', "ext" = $attach'extension', "ratio" = fals...
CVE-2008-5771: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in test.php in PHP Weather 2.2.2 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the language parameter...
PHP Weather 2.2.2 (LFI/XSS) Multiple Remote Vulnerabilities
Exploit for unknown platform in category web applications =========================================================== PHP Weather 2.2.2 LFI/XSS Multiple Remote Vulnerabilities =========================================================== Lfi/xss script: phpweather-2.2.2 download...
PHP weather 2.2.2 - Local File Inclusion / Cross-Site Scripting
Lfi/xss script: phpweather-2.2.2 download from:http://downloads.sourceforge.net/phpweather/phpweather-2.2.2.zip?modtime=1087430400&bigmirror=0 vul: /test.php line 48: requirePHPWEATHERBASEDIR . "/output/pwtext$language.php"; xpl: www.site.com/path/test.php?metar=&language=Lfi%00...
CVE-2008-4182: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in imp/test.php in Horde Turba Contact Manager H3 2.2.1 and other versions before 2.3.1, and possibly other Horde Project products, allows remote attackers to inject arbitrary web script or HTML via the User field in an IMAP session...
Information disclosure
Just For Fun Network Management System JFFNMS 0.8.3 allows remote attackers to obtain configuration information via a direct request to admin/adm/test.php, which calls the phpinfo function...
CVE-2007-3191
Just For Fun Network Management System JFFNMS 0.8.3 allows remote attackers to obtain configuration information via a direct request to admin/adm/test.php, which calls the phpinfo function...
CVE-2007-3191: Undefined Security Weakness
Just For Fun Network Management System JFFNMS 0.8.3 allows remote attackers to obtain configuration information via a direct request to admin/adm/test.php, which calls the phpinfo function...
CVE-2006-4528
Multiple cross-site scripting XSS vulnerabilities in membrepass 1.5 allow remote attackers to inject arbitrary web script or HTML via the 1 recherche parameter in recherchemembre.php and the 2 email parameter in test.php...
CVE-2006-4528: Undefined Security Weakness
Multiple cross-site scripting XSS vulnerabilities in membrepass 1.5 allow remote attackers to inject arbitrary web script or HTML via the 1 recherche parameter in recherchemembre.php and the 2 email parameter in test.php...
SmartSiteCMS 1.0 (root) Multiple Remote File Inclusion Vulnerabilities
No description provided by source. smartsite cms v1.0 Multiple Remote File include ------------------------------------------------- Discovered By CrAshoVeRrIdE Arabian Security Team ------------------------------------------------- site of script:www.smartsitecms.net...
SmartSiteCMS 1.0 (root) Multiple Remote File Inclusion Vulnerabilities
Exploit for unknown platform in category web applications ====================================================================== SmartSiteCMS 1.0 root Multiple Remote File Inclusion Vulnerabilities ====================================================================== smartsite cms v1.0 Multiple...