1051 matches found
CVE-2007-0839
Multiple PHP remote file inclusion vulnerabilities in index/indexalbum.php in Valarsoft WebMatic 2.6 allow remote attackers to execute arbitrary PHP code via a URL in the 1 PLIB and 2 PINDEX parameters...
CVE-2007-0150: Undefined Security Weakness
Multiple PHP remote file inclusion vulnerabilities in index.php in Dayfox Blog allow remote attackers to execute arbitrary PHP code via a URL in the 1 page, 2 subject, and 3 q parameters...
CVE-2006-5402
Multiple PHP remote file inclusion vulnerabilities in PHPmybibli 3.0.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the 1 classpath, 2 javascriptpath, and 3 includepath parameters in a cart.php; the 4 classpath parameter in b index.php; the 5 javascriptpath...
PT-2006-5762 · Redgun · Redblog
Name of the Vulnerable Software and Affected Versions: redgun RedBLoG version 0.5 Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in several parameters, including the root parameter in "imgen.php", and the root path parameter in "admin/config.php",...
CVE-2006-3584
Dynamic variable evaluation vulnerability in index.php in Jetbox CMS 2.1 SR1 allows remote attackers to overwrite configuration variables via URL parameters, which are evaluated as PHP variable variables...
CVE-2006-3584
Dynamic variable evaluation vulnerability in index.php in Jetbox CMS 2.1 SR1 allows remote attackers to overwrite configuration variables via URL parameters, which are evaluated as PHP variable variables...
CVE-2006-3826
Multiple cross-site scripting XSS vulnerabilities in Kailash Nadh boastMachine formerly bMachine 3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 userlogin, 2 fullname, and 3 URL parameters in register.php; and allow remote authenticated administrators to...
PT-2006-3947 · Ispconfig · Ispconfig
Name of the Vulnerable Software and Affected Versions: ISPConfig version 2.2.3 Description: Multiple PHP remote file inclusion issues allow remote attackers to execute arbitrary PHP code via a URL in the go infoispclasses root parameter in server.inc.php, and the go infoserverclasses root paramet...
PeerCast URL Handling Buffer Overflow
This module exploits a stack buffer overflow in PeerCast use exploit/windows/http/peercast/url msf undefinedurl show actions ...actions... msf undefinedurl set ACTION msf undefinedurl show options ...show and set options... msf undefinedurl run This module requires Metasploit:...
SoftMaker Shop is vulnerable to XSS
Inputs in the SoftMaker Shop is not properly sanitized, and XSS is possible in a lot of the systems input fields and url parameters. Some fields have been filtered in a basic form, so that simple scripting like "scriptalert'XSS'/script" is not possible. However, since the filtering is not based o...
cerberusXSS.txt
Inputs in the Cerberus Helpdesk is not properly sanitized, and XSS is possible in a lot of the systems input fields and url parameters. You can add XSS that will hit every user of the system, and even simple scripting tags like alertf is allowed PoC:...
BrowserCRM vulnerable for XSS
Inputs in the BrowserCRM is not properly sanitized, and XSS is possible in a lot of the systems input fields and url parameters. Some fields have been filtered in a basic form, so that simple scripting like "scriptalert'XSS'/script" is not possible. Howevere, since the filtering is not based on...
Cerberus Helpdesk vulnerable to XSS
Inputs in the Cerberus Helpdesk is not properly sanitized, and XSS is possible in a lot of the systems input fields and url parameters. You can add XSS that will hit every user of the system, and even simple scripting tags like scriptalert‘f’/script is allowed PoC:...
ar-blogv5.2.txt
Software: ar-blog Web Site: http://www.ar-blog.com Versions: ar-blog v 5.2 Type: Cross Site Scripting Class: Remote Exploit : 1- http://www.target.com/index.php?page=showtopis&month=XSS&year=1426&all=9 2- http://www.target.com/index.php?page=showtopis&month=9&year=XSS&all=9 Example : 1-...
CVE-2005-4439
Buffer overflow in ELOG elogd 2.6.0-beta4 allows remote attackers to cause a denial of service application crash and possibly execute arbitrary code via a URL with a long 1 cmd or 2 mode parameter...
CVE-2004-2193
The CVE-2004-2193 issue affects CJOverkill’s trade.php (versions older than 4.0.4) with a cross-site scripting (XSS) vulnerability. The flaw arises from insufficient sanitization of user-supplied input, enabling remote attackers to inject script via the tms[0] or url parameters. OpenVAS entries c...
CVE-2005-0723
Cross-site scripting XSS vulnerability in the jumpmenu function in functions.php for paFileDB 3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the URL parameters, which is not properly cleansed in the $pageurl variable, as demonstrated using pafiledb.php...
CVE-2005-0723
Cross-site scripting XSS vulnerability in the jumpmenu function in functions.php for paFileDB 3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the URL parameters, which is not properly cleansed in the $pageurl variable, as demonstrated using pafiledb.php...
CVE-2004-0265
Cross-site scripting XSS vulnerability in modules.php for Php-Nuke 6.x-7.1.0 allows remote attackers to execute arbitrary script as other users via URL-encoded 1 title or 2 fname parameters in the News or Reviews modules...
CVE-2002-1430
CVE-2002-1430 : Unknown vulnerability in Sympoll 1.2 allows remote attackers to read arbitrary files when register_globals is enabled, possibly by modifying certain PHP variables through URL parameters. Exploitation details are not provided in the connected documents; the description indicates a ...