CVE-2011-2153

CVE-2011-2153 affects SmarterTools SmarterStats 6.0 Web server. The vulnerability arises from Login.aspx accepting txtUser/txtPass in the query string, enabling context-dependent attackers to discover credentials by reading server access logs, Referer logs, or browser history (cross-domain Refere...

CVE-2011-1669

Directory traversal vulnerability in wp-download.php in the WP Custom Pages module 0.5.0.1 for WordPress allows remote attackers to read arbitrary files via ..%2F encoded dot dot sequences in the url parameter...

Directory traversal

Directory traversal vulnerability in wp-download.php in the WP Custom Pages module 0.5.0.1 for WordPress allows remote attackers to read arbitrary files via ..%2F encoded dot dot sequences in the url parameter...

Tramot CMS Local File Inclusion

Coder : baltazar a.k.a b4ltazar CMS name : Tramot CMS WebSite : http://www.tramot.com/ Dork : inurl:downloadfile.php?file= site:hr LFI Vuln : http://www.site.hr/downloadfile.php?file=LFI greetz for d3hydr8, rsauron, low1z, qk, marezzi, StRoNiX, t0r3x, fx0, r0x and all members of ex darkc0de.com ,...

Unfixed XSS vulnerability at yellowpages.wsee.tv

Security researcher p0pc0rn, has submitted on 23/02/2011 a cross-site-scripting XSS vulnerability affecting yellowpages.wsee.tv, which at the time of submission ranked 11890905 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 11/12/2011. It is...

Novell iPrint Client Netscape Plugin call-back-url Parameter Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell iPrint Client. Authentication is not required to exploit this vulnerability. The flaw exists within the npnipp.dll Mozilla browser plugin for iPrint client. When assembling a URL using the...

CVE-2010-4361

Cross-site scripting XSS vulnerability in url-gateway.php in Jurpopage 0.2.0 allows remote attackers to inject arbitrary web script or HTML via the url parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Angel LMS 7.3 Cross Site Scripting

I have discovered a security exploit in Angel LMS 7.3 "Colleges and universities worldwide choose the ANGEL LMS to deliver powerful online teaching and learning experiences. ANGEL provides the comprehensive LMS features institutions need in a simple interface that promotes adoption. A recognized...

CVE-2010-4097

Multiple cross-site scripting XSS vulnerabilities in index.php in Aardvark Topsites PHP 5.2.0 and 5.2.1 allow remote attackers to inject arbitrary web script or HTML via the 1 mail, 2 title, 3 u, and 4 url parameters. NOTE: the q parameter is already covered by CVE-2009-2302...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in index.php in Aardvark Topsites PHP 5.2.0 and 5.2.1 allow remote attackers to inject arbitrary web script or HTML via the 1 mail, 2 title, 3 u, and 4 url parameters. NOTE: the q parameter is already covered by CVE-2009-2302...

CVE-2010-3425

Cross-site scripting XSS vulnerability in UserControls/Popups/frmHelp.aspx in SmarterStats 5.3, 5.3.3819, and possibly other 5.3 versions, allows remote attackers to inject arbitrary web script or HTML via the url parameter...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in Haudenschilt Family Connections CMS FCMS 2.2.3 allow remote attackers to execute arbitrary PHP code via a URL in the currentuserid parameter to 1 familynews.php and 2 settings.php...

PHP Classifieds ADS - 'sid' Blind SQL Injection

Title: PHP CLASSIFIEDS ADS Price: $49 Link : http://www.sellatsite.com/sellatsite/phpclass.asp Author: BorN To K!LL - h4ck3r 3xploit: /detail.php?sid=Blind-Injection 3xample: http://www.example.com/classi/detail.php?sid=80 and 1=1-- // True ,, http://www.example.com/classi/detail.php?sid=80 and...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in Pecio CMS 2.0.5 allow remote attackers to execute arbitrary PHP code via a URL in the template parameter to 1 post.php, 2 article.php, 3 blog.php, or 4 home.php in pectemplates/nova-blue/...

CVE-2010-3205

PHP remote file inclusion vulnerability in index.php in Textpattern CMS 4.2.0 allows remote attackers to execute arbitrary PHP code via a URL in the inc parameter...

Remote file inclusion

PHP remote file inclusion vulnerability in home.php in LM Starmail Paidmail 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter...

Remote file inclusion

PHP remote file inclusion vulnerability in index.php in MyBackup 1.4.0 allows remote authenticated users to execute arbitrary PHP code via a URL in the maincontent parameter...

Sql injection

SQL injection vulnerability in myLDlinker.php in the myLinksDump Plugin 1.2 for WordPress allows remote attackers to execute arbitrary SQL commands via the url parameter. NOTE: some of these details are obtained from third party information...

CVE-2010-2852

Cross-site scripting XSS vulnerability in modules/headlines/magpierss/scripts/magpiedebug.php in RunCms 2.1, when the Headlines module is enabled, allows remote attackers to inject arbitrary web script or HTML via the url parameter...

CVE-2010-2852

Cross-site scripting XSS vulnerability in modules/headlines/magpierss/scripts/magpiedebug.php in RunCms 2.1, when the Headlines module is enabled, allows remote attackers to inject arbitrary web script or HTML via the url parameter...