CVE-2007-4120

Multiple PHP remote file inclusion vulnerabilities in Jelsoft vBulletin 3.6.5 allow remote attackers to execute arbitrary PHP code via a URL in the 1 classfile parameter to includes/functions.php, the 2 nextitem parameter to includes/functionscron.php, and the 3 specialtemplates parameter to...

Unfixed XSS vulnerability at search.doe.mass.edu

Security researcher Genocide, has submitted on 07/12/2007 a cross-site-scripting XSS vulnerability affecting search.doe.mass.edu, which at the time of submission ranked 53537 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 10/12/2007. It is...

EUVD-2007-2590

Multiple PHP remote file inclusion vulnerabilities in telltarget CMS 1.3.3 allow remote attackers to execute arbitrary PHP code via a URL in the 1 ordnertiefe parameter to siteconf.php; or the 2 ttdocroot parameter to a class.csv.php, b produktenachserie.php, or c refkdrubrik.php in functionen/; ...

CVE-2007-2340

Multiple PHP remote file inclusion vulnerabilities in inc/includeall.inc.php in phporacleview allow remote attackers to execute arbitrary PHP code via a URL in the 1 pagedir or 2 incdir parameters...

CVE-2007-2089

Multiple PHP remote file inclusion vulnerabilities in the Jx Development Article 1.1 and earlier component for Mambo and Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the absolutepath parameter to comarticles.php in 1 components/ or 2 classes/html/...

Unfixed XSS vulnerability at www.carsearch.co.uk

Security researcher INull, has submitted on 03/08/2007 a cross-site-scripting XSS vulnerability affecting www.carsearch.co.uk, which at the time of submission ranked 3140641 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 07/08/2007. It is...

CVE-2007-1360: Undefined Security Weakness

Unspecified vulnerability in the Nodefamily module for Drupal 5.x before 5.x-1.0 allows remote authenticated users to access and modify other users' profiles via unspecified URL parameters...

Unfixed XSS vulnerability at mujerestam.com

Security researcher TurkProtest, has submitted on 03/03/2007 a cross-site-scripting XSS vulnerability affecting mujerestam.com, which at the time of submission ranked 3724528 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 05/03/2007. It is...

CVE-2006-7045

PHP remote file inclusion vulnerability in Clan Manager Pro CMPRO 1.1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the 1 rootpath and possibly 2 sitepath parameters to a cmpro.ext/comment.core.inc.php and b cmpro.intern/comment.core.inc.php. NOTE: the provenanc...

Unfixed XSS vulnerability at www.airtightnetworks.net

Security researcher i-landet, has submitted on 17/02/2007 a cross-site-scripting XSS vulnerability affecting www.airtightnetworks.net, which at the time of submission ranked 790432 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 17/02/2007. It ...

CVE-2007-0839

Multiple PHP remote file inclusion vulnerabilities in index/indexalbum.php in Valarsoft WebMatic 2.6 allow remote attackers to execute arbitrary PHP code via a URL in the 1 PLIB and 2 PINDEX parameters...

CVE-2007-0150: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in index.php in Dayfox Blog allow remote attackers to execute arbitrary PHP code via a URL in the 1 page, 2 subject, and 3 q parameters...

CVE-2006-5402

Multiple PHP remote file inclusion vulnerabilities in PHPmybibli 3.0.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the 1 classpath, 2 javascriptpath, and 3 includepath parameters in a cart.php; the 4 classpath parameter in b index.php; the 5 javascriptpath...

PT-2006-5762 · Redgun · Redblog

Name of the Vulnerable Software and Affected Versions: redgun RedBLoG version 0.5 Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in several parameters, including the root parameter in "imgen.php", and the root path parameter in "admin/config.php",...

CVE-2006-3584

Dynamic variable evaluation vulnerability in index.php in Jetbox CMS 2.1 SR1 allows remote attackers to overwrite configuration variables via URL parameters, which are evaluated as PHP variable variables...

CVE-2006-3584

Dynamic variable evaluation vulnerability in index.php in Jetbox CMS 2.1 SR1 allows remote attackers to overwrite configuration variables via URL parameters, which are evaluated as PHP variable variables...

CVE-2006-3826

Multiple cross-site scripting XSS vulnerabilities in Kailash Nadh boastMachine formerly bMachine 3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 userlogin, 2 fullname, and 3 URL parameters in register.php; and allow remote authenticated administrators to...

PT-2006-3947 · Ispconfig · Ispconfig

Name of the Vulnerable Software and Affected Versions: ISPConfig version 2.2.3 Description: Multiple PHP remote file inclusion issues allow remote attackers to execute arbitrary PHP code via a URL in the go infoispclasses root parameter in server.inc.php, and the go infoserverclasses root paramet...

PeerCast URL Handling Buffer Overflow

This module exploits a stack buffer overflow in PeerCast use exploit/windows/http/peercast/url msf undefinedurl show actions ...actions... msf undefinedurl set ACTION msf undefinedurl show options ...show and set options... msf undefinedurl run This module requires Metasploit:...

SoftMaker Shop is vulnerable to XSS

Inputs in the SoftMaker Shop is not properly sanitized, and XSS is possible in a lot of the systems input fields and url parameters. Some fields have been filtered in a basic form, so that simple scripting like "scriptalert'XSS'/script" is not possible. However, since the filtering is not based o...