CVE-2007-3129

Cross-site scripting XSS vulnerability in login.php in Utopia News Pro 1.4.0 allows remote attackers to inject arbitrary web script or HTML via the password parameter...

CVE-2007-3129

Cross-site scripting XSS vulnerability in login.php in Utopia News Pro 1.4.0 allows remote attackers to inject arbitrary web script or HTML via the password parameter...

CVE-2007-3129

CVE-2007-3129 concerns an XSS vulnerability in Utopia News Pro 1.4.0, specifically in login.php where the password parameter can be exploited to inject script/HTML. The vulnerability is described across multiple sources (NVD, CVE records, and Full-Disclosure material), with exploitation details i...

utopia-xss.txt

netVigilance Security Advisory 34 Utopia News Pro version 1.4.0 XSS Attack Vulnerability Description: Utopia News Pro is a powerful and scalable news management system for any web site. News Pro, written in PHP and backed by the renowned MySQL database system, Utopia Software's News Pro is an ide...

CVE-2007-3129: Undefined Security Weakness

Cross-site scripting XSS vulnerability in login.php in Utopia News Pro 1.4.0 allows remote attackers to inject arbitrary web script or HTML via the password parameter...

[Full-disclosure] Utopia News Pro version 1.4.0 XSS Attack Vulnerability

netVigilance Security Advisory 34 Utopia News Pro version 1.4.0 XSS Attack Vulnerability Description: Utopia News Pro is a powerful and scalable news management system for any web site. News Pro, written in PHP and backed by the renowned MySQL database system, Utopia Software's News Pro is an ide...

CVE-2005-4223

Multiple "potential" SQL injection vulnerabilities in Utopia News Pro UNP 1.1.4 might allow remote attackers to execute arbitrary SQL commands via 1 the newsid parameter in editnews.php, 2 the catid and question parameters in faq.php, 3 the poster parameter in postnews.php, 4 the tempid parameter...

CVE-2005-4223

Utopia News Pro (UNP) 1.1.4 is affected by multiple potential SQL injection vulnerabilities that could allow an attacker to run arbitrary SQL commands remotely. The issues are reported in specific input parameters across several PHP scripts: newsid in editnews.php, catid and question in faq.php, ...

CVE-2005-4223

Multiple "potential" SQL injection vulnerabilities in Utopia News Pro UNP 1.1.4 might allow remote attackers to execute arbitrary SQL commands via 1 the newsid parameter in editnews.php, 2 the catid and question parameters in faq.php, 3 the poster parameter in postnews.php, 4 the tempid parameter...

CVE-2005-4223: Undefined Security Weakness

Multiple "potential" SQL injection vulnerabilities in Utopia News Pro UNP 1.1.4 might allow remote attackers to execute arbitrary SQL commands via 1 the newsid parameter in editnews.php, 2 the catid and question parameters in faq.php, 3 the poster parameter in postnews.php, 4 the tempid parameter...

[PHP-CHECKER] 99 potential SQL injection vulnerabilities

Hi, we are a group of Stanford researchers and we have recently developed an automated tool for detecting injection vulnerabilities in PHP. We ran our tool on the following list of software and found 99 potential security vulnerabilites inspected bug reports attached below: e107 -- v0.7 myBloggie...

CVE-2005-3200

Multiple cross-site scripting XSS vulnerabilities in Utopia News Pro UNP 1.1.3 and 1.1.4 allow remote attackers to inject arbitrary web script or HTML via 1 the sitetitle parameter in header.php and 2 the version and 3 querycount parameters in footer.php...

CVE-2005-3201

SQL injection vulnerability in news.php for Utopia News Pro UNP 1.1.3, when magicquotesgpc is disabled and registerglobals is enabled, allows remote attackers to execute arbitrary SQL via the newsid parameter...

CVE-2005-3201

SQL injection vulnerability in news.php for Utopia News Pro UNP 1.1.3, when magicquotesgpc is disabled and registerglobals is enabled, allows remote attackers to execute arbitrary SQL via the newsid parameter...

CVE-2005-3200

Multiple cross-site scripting XSS vulnerabilities in Utopia News Pro UNP 1.1.3 and 1.1.4 allow remote attackers to inject arbitrary web script or HTML via 1 the sitetitle parameter in header.php and 2 the version and 3 querycount parameters in footer.php...

CVE-2005-3200

Utopia News Pro (UNP) versions 1.1.3 and 1.1.4 are affected by multiple XSS vulnerabilities. The issue allows remote attackers to inject arbitrary web script or HTML via: (1) sitetitle parameter in header.php and (2) version and (3) query_count parameters in footer.php. The documents do not speci...

CVE-2005-3201

CVE-2005-3201 concerns Utopia News Pro (UNP) 1.1.3. The vulnerability is an SQL injection in news.php when magic_quotes_gpc is disabled and register_globals is enabled, allowing remote attackers to modify/obtain data via the newsid parameter. The NVD entry lists a CVSS v2 base score of 7.5 (HIGH)...

CVE-2005-3201: Undefined Security Weakness

SQL injection vulnerability in news.php for Utopia News Pro UNP 1.1.3, when magicquotesgpc is disabled and registerglobals is enabled, allows remote attackers to execute arbitrary SQL via the newsid parameter...

CVE-2005-3200: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Utopia News Pro UNP 1.1.3 and 1.1.4 allow remote attackers to inject arbitrary web script or HTML via 1 the sitetitle parameter in header.php and 2 the version and 3 querycount parameters in footer.php...

Utopia News Pro 1.1.3 SQL Injection / cross site scripting

2.56 07/10/2005 Utopia News Pro 1.1.3 SQL Injection / cross site scripting software: site: http://www.utopiasoftware.net axss: http://target/path/header.php?sitetitle=/titlescriptalertdocument.cookie/script!-- http://target/path/footer.php?version=scriptalertdocument.cookie/script...