CVE-2007-5010

Cross-site scripting XSS vulnerability in WebBatch allows remote attackers to inject arbitrary web script or HTML via the URL to webbatch.exe...

CVE-2007-1280

Cross-site scripting XSS vulnerability in Adobe RoboHelp X5, 6, and Server 6 allows remote attackers to inject arbitrary web script or HTML via a URL after a hash in the URL path, as demonstrated using en/frameset-7.html, and possibly other unspecified vectors involving templates and 1 whstart.js...

advisory-php-gaestebuch-en.txt

-------------------------------------------------------- PHP-Gaestebuch v1.63 Script Injection Vulnerability | Discovered by Trew | ICEnetX Team http://icenetx.net | http://trew.icenetx.net [email protected] | -------------------------------------------------------- Date: 04 marzo 2007...

XSS in eWay

hey guys .. check out this new xss i just found ;P Vulnerable : eWay web : http://www.eway.no/eway XSS : http://127.0.0.1/path/default.aspx?pid="scriptalert'bl4ck'/script Discovered By BLacK ZeRo [email protected] Best regards ,,...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Bitweaver 1.3.1 allow remote attackers to inject arbitrary web script or HTML via the URL PATHINFO to 1 articles/edit.php, 2 articles/list.php, 3 blogs/listblogs.php, or 4 blogs/rankings.php...

CVE-2007-0526

Multiple cross-site scripting XSS vulnerabilities in Bitweaver 1.3.1 allow remote attackers to inject arbitrary web script or HTML via the URL PATHINFO to 1 articles/edit.php, 2 articles/list.php, 3 blogs/listblogs.php, or 4 blogs/rankings.php...

PHPMyphorum 1.5a (mep/frame.php) Remote File Include Vulnerability

Exploit for unknown platform in category web applications ================================================================== PHPMyphorum 1.5a mep/frame.php Remote File Include Vulnerability ================================================================== PHPMyphorum 1.5a Class: File Include...

CVE-2006-5460

CVE-2006-5460 describes multiple PHP remote file inclusion vulnerabilities in Hinton Design phpht Topsites that allow remote code execution via a URL parameter (phpht_real_path) to index.php, other top-level scripts, and admin scripts. The description notes CVE-2006-5460 is disputed because phpht...

CVE-2006-5137

Multiple direct static code injection vulnerabilities in Groupee UBB.threads 6.5.1.1 allow remote attackers to 1 inject PHP code via a theme array parameter to admin/doedittheme.php, which is injected into includes/theme.inc.php; 2 inject PHP code via a config array parameter to...

CVE-2006-3841

WebScarab is affected by an XSS flaw in its URL handling: before 20060718-1904, when used with IE 6 SP2 or Konqueror 3.5.3, it returns the requested URL in an error message without sanitizing script/HTML. This can allow remote attackers to inject arbitrary web script or HTML. The connected docume...

about.txt

About.com Homepage: http://www.about.com Effected files: Search input box fullsearch.htm shortform.htm forum.aspx profilecenter.asp posting in the forum ----------------------------------- Search input box xss vuln with cookie disclosure: Works by putting the tags in the input box, or doing url...

CVE-2006-3044

CVE-2006-3044 is a documented XSS in LogiSphere 1.6.0. The vulnerability allows remote attackers to inject arbitrary web script or HTML via the URL, with the malicious code reflected in an error page. The NVD entry provides a CVSSv2 base score of 2.6 (LOW) with vector AV:N/AC:H/Au:N/C:N/I:P/A:N. ...

f_dp-6.1.x.txt

----------------------------------------------------- Advisory id: FSA:013 Author: Federico Fazzi Date: 12/06/2006, 9:31 Sinthesis: DCP-Portal 6.1.x, Remote command execution Type: high Product: http://www.dcp-portal.org/ Patch: unavailable ----------------------------------------------------- 1...

okscripts.com - XSS Vulns

OkMall v1.0 Homepage: http://www.okscripts.com/ Effected files: search.php XSS Vulnerabilities: The search inputbox doesn’t properally filter using input before generating it. Backslashes areadded but we can easily evade this. ForPoC try putting a imgsrc=lol.jpgin the search box. XSS vuln via...

P.A.I.D v2.2

P.A.I.D v2.2 Homepage: http://www.webexceluk.net Effected files: faq.php input form of logging in. index.php The input forms of logging into My Account do not sanatize user input. For PoC of a XSS attack simply put in: "IMG SRC=javascript:alert'XSS'" It also seems when logging in, even if your...

PHP ManualMaker v1.0

PHP ManualMaker v1.0 Homepage: http://deltascripts.com/phpmanualmaker/ Effected files: index.php Search boxes Comment boxes XSS proof of concept: Input in search or comment box: """'IMG SRC=javascript:alert&0000039XSS&0000039""'" XSS via URL injection of id:...

TAL RateMyPic v1.0

TAL RateMyPic v1.0 Homepage: http://www.dominioseuropa.com/index.php Effected files: index.php input boxes XSS proof of concept: By putting the following in the name, email, or comment boxes: IMG SRC=javascript:alert'XSS' And By URL Injection:...

Pretty Guestbook v1

Homepage: http://www.tuttophp.altervista.org/main.php Description: Text-based guestbook with the following features: - Data storing on text file - Paging of messages on screen - Blockage of messages with words too long into - Blockage of messages with both html tags - Validity-checking of email...

Pre Shopping Mall v1.0

Pre Shopping Mall Homepage: http://www.preprojects.com/emall.asp Description: PRE SHOPPING MALL a power full ecommerce shopping mall solution. If you need to setup a online shop or shopping mall PRE SHOPPING MALL is your quickest solution. You can setup your Emall within few hours. Buy install an...

AlstraSoft Web Host Directory v1.2

AlstraSoft Web Host Directory v1.2 Homepage: http://www.alstrasoft.com/ It should be noted too that the demo for this script is on a different domain which also sells a WebHost Directory which looks to be the same product/company called HyperStop WebHost Directory 1.2. Both scripts seem to be the...