PHPWind 6.0 multiple cross-site scripting vulnerability-vulnerability warning-the black bar safety net

PHPWind is a domestic of the more popular PHP-based Web forum application. PHPWind 在 访客 注销 时 没有 正确 的 过滤 提交 给 hack.php and search.php and read.php and post.php and thread.php and profile.php and sort.php and message.php and userpay. php, etc. page of request parameters, a remote attacker can submi...

PHPWind 6.0 Cross Site Scripting

I found the PHPWind v6.0 just filter the xss code when the visitors login in, but it doesnt do it when login off. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This flaw makes its all the parameters...

CVE-2008-5726

SQL injection vulnerability in thread.php in stormBoards 1.0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2008-5726

CVE-2008-5726 describes an SQL injection in stormBoards 1.0.1's thread.php that lets remote attackers execute arbitrary SQL commands via the id parameter. Affected software: stormBoards 1.0.1; vulnerable component: thread.php. Root cause: unsafely concatenated SQL queries exposed to user-supplied...

CVE-2008-5726: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in thread.php in stormBoards 1.0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter...

StormBoard 1.0.1 (thread.php id) SQL Injection Vulnerability

Exploit for unknown platform in category web applications ============================================================ StormBoard 1.0.1 thread.php id SQL Injection Vulnerability ============================================================...

Unfixed XSS vulnerability at www.xoxohth.com

Security researcher Mystick, has submitted on 11/11/2008 a cross-site-scripting XSS vulnerability affecting www.xoxohth.com, which at the time of submission ranked 194585 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 04/02/2009. It is current...

CVE-2008-2395: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in thread.php in AlkalinePHP 0.80.00 beta and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter...

AlkalinePHP 0.80.00 Beta - thread.php SQL Injection

AlkalinePHP 0.80.00 Beta - thread.php SQL Injection !/usr/bin/perl -w Portal : AlkalinePHP see down Greetz : Houssamix & Djekmani & Jadi & iuoisn & All muslims HaCkeRs : ---------------------------------------------------------------------------- TITLE: PerlSploit Class REQUIREMENTS: PHP 4 / PHP ...

Unfixed XSS vulnerability at www.happyout.com.cn

Security researcher BackDoor, has submitted on 12/09/2007 a cross-site-scripting XSS vulnerability affecting www.happyout.com.cn, which at the time of submission ranked 2052500 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 17/09/2007. It is...

CVE-2007-1515: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Horde IMP H3 4.1.3, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via 1 the email Subject header in thread.php, 2 the editquery parameter in search.php, or other unspecified parameters in search.php. NOTE:...

CVE-2006-6237

SQL injection vulnerability in the decodecookie function in thread.php in Woltlab Burning Board Lite 1.0.2 allows remote attackers to execute arbitrary SQL commands via the threadvisit Cookie parameter...

CVE-2006-6237

The CVE-2006-6237 entry describes a SQL injection in Woltlab Burning Board Lite 1.0.2, via the decode_cookie function in thread.php. An attacker can send a crafted threadvisit Cookie parameter to trigger arbitrary SQL execution, with remote, unauthenticated access. The available documents confirm...

CVE-2006-6237: Undefined Security Weakness

SQL injection vulnerability in the decodecookie function in thread.php in Woltlab Burning Board Lite 1.0.2 allows remote attackers to execute arbitrary SQL commands via the threadvisit Cookie parameter...

CVE-2006-5029

The CVE-2006-5029 entry describes an SQL injection in thread.php of WoltLab Burning Board (wBB) 2.3.x, allowing remote attackers to obtain the PHP, MySQL, and wBB version numbers via the page parameter. The report notes the issue may be a forced SQL error and that the original report was disputed...

CVE-2006-5029: Undefined Security Weakness

SQL injection vulnerability in thread.php in WoltLab Burning Board wBB 2.3.x allows remote attackers to obtain the version numbers of PHP, MySQL, and wBB via the page parameter. NOTE: this issue might be a forced SQL error. Also, the original report was disputed by a third party for 2.3.3 and 2.3...

CVE-2006-3219

SQL injection vulnerability in thread.php in Woltlab Burning Board WBB 2.2.2 allows remote attackers to execute arbitrary SQL commands via the threadid parameter...

CVE-2006-3219

SQL injection vulnerability in thread.php in Woltlab Burning Board WBB 2.2.2 allows remote attackers to execute arbitrary SQL commands via the threadid parameter...

CVE-2006-3219

CVE-2006-3219 describes an SQL injection in thread.php of Woltlab Burning Board (WBB) 2.2.2, allowing remote attackers to execute arbitrary SQL via the threadid parameter. The issue affects the WBB component and under the provided documents yields a CVSS base score of 7.5 (HIGH) with network atta...

CVE-2006-3219: Undefined Security Weakness

SQL injection vulnerability in thread.php in Woltlab Burning Board WBB 2.2.2 allows remote attackers to execute arbitrary SQL commands via the threadid parameter...