CVE-2007-4120

Multiple PHP remote file inclusion vulnerabilities in Jelsoft vBulletin 3.6.5 allow remote attackers to execute arbitrary PHP code via a URL in the 1 classfile parameter to includes/functions.php, the 2 nextitem parameter to includes/functionscron.php, and the 3 specialtemplates parameter to...

Unfixed XSS vulnerability at search.doe.mass.edu

Security researcher Genocide, has submitted on 07/12/2007 a cross-site-scripting XSS vulnerability affecting search.doe.mass.edu, which at the time of submission ranked 53537 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 10/12/2007. It is...

EUVD-2007-2590

Multiple PHP remote file inclusion vulnerabilities in telltarget CMS 1.3.3 allow remote attackers to execute arbitrary PHP code via a URL in the 1 ordnertiefe parameter to siteconf.php; or the 2 ttdocroot parameter to a class.csv.php, b produktenachserie.php, or c refkdrubrik.php in functionen/; ...

CVE-2007-2340

Multiple PHP remote file inclusion vulnerabilities in inc/includeall.inc.php in phporacleview allow remote attackers to execute arbitrary PHP code via a URL in the 1 pagedir or 2 incdir parameters...

CVE-2007-2089

Multiple PHP remote file inclusion vulnerabilities in the Jx Development Article 1.1 and earlier component for Mambo and Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the absolutepath parameter to comarticles.php in 1 components/ or 2 classes/html/...

Unfixed XSS vulnerability at www.carsearch.co.uk

Security researcher INull, has submitted on 03/08/2007 a cross-site-scripting XSS vulnerability affecting www.carsearch.co.uk, which at the time of submission ranked 3140641 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 07/08/2007. It is...

Unfixed XSS vulnerability at mujerestam.com

Security researcher TurkProtest, has submitted on 03/03/2007 a cross-site-scripting XSS vulnerability affecting mujerestam.com, which at the time of submission ranked 3724528 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 05/03/2007. It is...

CVE-2006-7045

PHP remote file inclusion vulnerability in Clan Manager Pro CMPRO 1.1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the 1 rootpath and possibly 2 sitepath parameters to a cmpro.ext/comment.core.inc.php and b cmpro.intern/comment.core.inc.php. NOTE: the provenanc...

Unfixed XSS vulnerability at www.airtightnetworks.net

Security researcher i-landet, has submitted on 17/02/2007 a cross-site-scripting XSS vulnerability affecting www.airtightnetworks.net, which at the time of submission ranked 790432 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 17/02/2007. It ...

CVE-2007-0839

Multiple PHP remote file inclusion vulnerabilities in index/indexalbum.php in Valarsoft WebMatic 2.6 allow remote attackers to execute arbitrary PHP code via a URL in the 1 PLIB and 2 PINDEX parameters...

CVE-2006-5402

Multiple PHP remote file inclusion vulnerabilities in PHPmybibli 3.0.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the 1 classpath, 2 javascriptpath, and 3 includepath parameters in a cart.php; the 4 classpath parameter in b index.php; the 5 javascriptpath...

PT-2006-5762 · Redgun · Redblog

Name of the Vulnerable Software and Affected Versions: redgun RedBLoG version 0.5 Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in several parameters, including the root parameter in "imgen.php", and the root path parameter in "admin/config.php",...

CVE-2006-3584

Dynamic variable evaluation vulnerability in index.php in Jetbox CMS 2.1 SR1 allows remote attackers to overwrite configuration variables via URL parameters, which are evaluated as PHP variable variables...

CVE-2006-3584

Dynamic variable evaluation vulnerability in index.php in Jetbox CMS 2.1 SR1 allows remote attackers to overwrite configuration variables via URL parameters, which are evaluated as PHP variable variables...

CVE-2006-3826

Multiple cross-site scripting XSS vulnerabilities in Kailash Nadh boastMachine formerly bMachine 3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 userlogin, 2 fullname, and 3 URL parameters in register.php; and allow remote authenticated administrators to...

PT-2006-3947 · Ispconfig · Ispconfig

Name of the Vulnerable Software and Affected Versions: ISPConfig version 2.2.3 Description: Multiple PHP remote file inclusion issues allow remote attackers to execute arbitrary PHP code via a URL in the go infoispclasses root parameter in server.inc.php, and the go infoserverclasses root paramet...

PeerCast URL Handling Buffer Overflow

This module exploits a stack buffer overflow in PeerCast 'PeerCast URL Handling Buffer Overflow', 'Description' = %q This module exploits a stack buffer overflow in PeerCast 'hdm' , 'License' = MSFLICENSE, 'References' = 'CVE', '2006-1148', 'OSVDB', '23777', 'BID', '17040' , 'Privileged' = false,...

SoftMaker Shop is vulnerable to XSS

Inputs in the SoftMaker Shop is not properly sanitized, and XSS is possible in a lot of the systems input fields and url parameters. Some fields have been filtered in a basic form, so that simple scripting like "scriptalert'XSS'/script" is not possible. However, since the filtering is not based o...

cerberusXSS.txt

Inputs in the Cerberus Helpdesk is not properly sanitized, and XSS is possible in a lot of the systems input fields and url parameters. You can add XSS that will hit every user of the system, and even simple scripting tags like alert‘f’ is allowed PoC:...

BrowserCRM vulnerable for XSS

Inputs in the BrowserCRM is not properly sanitized, and XSS is possible in a lot of the systems input fields and url parameters. Some fields have been filtered in a basic form, so that simple scripting like "scriptalert'XSS'/script" is not possible. Howevere, since the filtering is not based on...