CVE-2006-1573

PHP remote file inclusion vulnerability in index.php in MediaSlash Gallery allows remote attackers to execute arbitrary PHP code via a URL in the rub parameter part of the $pagemenu variable...

Remote file inclusion

PHP remote file include vulnerability in PageController.php in KnowledgebasePublisher 1.2 allows remote attackers to include and execute arbitrary PHP code via a URL in the dir parameter...

CVE-2005-4734

Stack-based buffer overflow in IISWebAgentIF.dll in RSA Authentication Agent for Web aka SecurID Web Agent 5.2 and 5.3 for IIS allows remote attackers to execute arbitrary code via a long url parameter in the Redirect method...

CVE-2006-1281

Cross-site scripting XSS vulnerability in member.php in MyBulletinBoard MyBB 1.04 allows remote attackers to inject arbitrary web script or HTML via the url parameter, a different vulnerability than CVE-2006-1272. NOTE: 1.10 was later reported to be vulnerable...

CVE-2006-1260

Horde Application Framework 3.0.9 allows remote attackers to read arbitrary files via a null character in the url parameter in services/go.php, which bypasses a sanity check...

Code injection

Horde Application Framework 3.0.9 allows remote attackers to read arbitrary files via a null character in the url parameter in services/go.php, which bypasses a sanity check...

CVE-2006-1260

Horde Application Framework 3.0.9 allows remote attackers to read arbitrary files via a null character in the url parameter in services/go.php, which bypasses a sanity check...

CVE-2006-1256

The CVE-2006-1256 entry corresponds to a cross-site scripting (XSS) vulnerability in Skull-Splitter’s PHP Guestbook (guestbook.php). Affected versions are 2.6 (and 2.7 per incident data) of Skull-Splitter’s PHP Guestbook. The root cause is improper sanitization of the url parameter, allowing remo...

CVE-2006-1281: Undefined Security Weakness

Cross-site scripting XSS vulnerability in member.php in MyBulletinBoard MyBB 1.04 allows remote attackers to inject arbitrary web script or HTML via the url parameter, a different vulnerability than CVE-2006-1272. NOTE: 1.10 was later reported to be vulnerable...

CVE-2006-1256: Undefined Security Weakness

Cross-site scripting XSS vulnerability in guestbook.php in Soren Boysen SkullSplitter PHP Guestbook 2.6 allows remote attackers to inject arbitrary web script or HTML via the url parameter...

horde -- "url" disclosure of sensitive information vulnerability

Secunia advisory SA19246: Paul Craig has discovered a vulnerability in Horde, which can be exploited by malicious people to disclose sensitive information. Input passed to the "url" parameter in "services/go.php" isn't properly verified, before it is used in a "readfile" call. This can be exploit...

Remote file inclusion

PHP remote file inclusion vulnerability in lib/OWLAPI.php in OWL Intranet Engine 0.82, when registerglobals is enabled, allows remote attackers to include arbitrary files via a URL in the xrmsfileroot parameter, which is not initialized before use...

CVE-2006-1099

PHP remote file include vulnerability in logIT 1.3 and 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the pg parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Remote file inclusion

PHP remote file include vulnerability in solmenu.php in PeHePe Uyelik Sistemi aka PeHePe MemberShip Management System 3 allows remote attackers to include and execute arbitrary PHP code via a URL in the uyeklasor parameter, along with a misafir parameter that is set to UYESEVIYE...

CVE-2006-0971: Undefined Security Weakness

Directory traversal vulnerability in Lionel Reyero DirectContact 0.3b allows remote attackers to read arbitrary files via a .. dot dot in the URL...

CVE-2006-0188

webmail.php in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to inject arbitrary web pages into the right frame via a URL in the rightframe parameter. NOTE: this has been called a cross-site scripting XSS issue, but it is different than what is normally identified as XSS...

Cross site scripting

Cross-site scripting XSS vulnerability in guestex.pl in Teca Scripts Guestex 1.0 allows remote attackers to inject arbitrary web script or HTML via the url parameter...

CVE-2006-0776

Cross-site scripting XSS vulnerability in guestex.pl in Teca Scripts Guestex 1.0 allows remote attackers to inject arbitrary web script or HTML via the url parameter...

CVE-2006-0776: Undefined Security Weakness

Cross-site scripting XSS vulnerability in guestex.pl in Teca Scripts Guestex 1.0 allows remote attackers to inject arbitrary web script or HTML via the url parameter...

CVE-2006-0731: Undefined Security Weakness

WmRoot/adapter-index.dsp in SAP Business Connector Core Fix 7 and earlier allows remote attackers to conduct spoofing phishing attacks via an absolute URL in the url parameter, which loads the URL inside a frame...