CVE-2008-0714: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in users.php in Mihalism Multi Host allows remote attackers to execute arbitrary SQL commands via the username parameter in a lostpasswordgo action...

CVE-2002-2319: Improper Control of Generation of Code

Static code injection vulnerability in users.php in MySimpleNews allows remote attackers to inject arbitrary PHP code and HTML via the 1 LOGIN, 2 DATA, and 3 MESS parameters, which are inserted into news.php3...

CVE-2003-1347: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Geeklog 1.3.7 allow remote attackers to inject arbitrary web script or HTML via the 1 cid parameter to comment.php, 2 uid parameter to profiles.php, 3 uid to users.php, and 4 homepage field...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in InterWorx Hosting Control Panel InterWorx-CP Webmaster Level SiteWorx 3.0.2 1 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to index.php; and allow remote authenticated users to inject arbitrary web script or HT...

CVE-2007-2715: Undefined Security Weakness

Admin/users.php in Snaps! Gallery 1.4.4 allows remote attackers to change arbitrary usernames and passwords via the 1 username, or the 2 password and password2 parameters in an edit action...

CVE-2007-2249: Undefined Security Weakness

include/controlcenter/users.php in Phorum before 5.1.22 allows remote authenticated moderators to gain privileges via a modified 1 userids POST parameter or 2 userdata array...

CVE-2007-2084

CVE-2007-2084 affects MobilePublisherphp version 1.1.2 and is described as a PHP remote file inclusion vulnerability in the admin directory. The issue permits an attacker to supply a URL in the auth_method parameter to any of the admin PHP files (index.php, list.php, postreview.php, reindex.php, ...

Sql injection

Multiple SQL injection vulnerabilities in phpx 3.5.15 allow remote attackers to execute arbitrary SQL commands via the 1 imageid or 2 catid parameter to a gallery.php; the 3 newsid parameter to b news.php or c print.php; 4 the newscatid parameter to news.php; the 5 catid, 6 topicid, or 7 postid...

CVE-2007-1550

Multiple SQL injection vulnerabilities in phpx 3.5.15 allow remote attackers to execute arbitrary SQL commands via the 1 imageid or 2 catid parameter to a gallery.php; the 3 newsid parameter to b news.php or c print.php; 4 the newscatid parameter to news.php; the 5 catid, 6 topicid, or 7 postid...

CVE-2007-1550: Undefined Security Weakness

Multiple SQL injection vulnerabilities in phpx 3.5.15 allow remote attackers to execute arbitrary SQL commands via the 1 imageid or 2 catid parameter to a gallery.php; the 3 newsid parameter to b news.php or c print.php; 4 the newscatid parameter to news.php; the 5 catid, 6 topicid, or 7 postid...

Code injection

Direct static code injection vulnerability in startsession.php in Flat Chat 2.0 allows remote attackers to execute arbitrary PHP code via the Chat Name field, which is inserted into online.txt and included by users.php. NOTE: some of these details are obtained from third party information...

CVE-2007-1394

Direct static code injection vulnerability in startsession.php in Flat Chat 2.0 allows remote attackers to execute arbitrary PHP code via the Chat Name field, which is inserted into online.txt and included by users.php. NOTE: some of these details are obtained from third party information...

CVE-2007-1394: Undefined Security Weakness

Direct static code injection vulnerability in startsession.php in Flat Chat 2.0 allows remote attackers to execute arbitrary PHP code via the Chat Name field, which is inserted into online.txt and included by users.php. NOTE: some of these details are obtained from third party information...

CVE-2006-4582

Cross-site request forgery CSRF vulnerability in The Address Book 1.04e allows remote attackers to perform unauthorized actions as other users via unspecified vectors, as demonstrated by deleting arbitrary users via the id parameter in a deleteuser action in users.php...

CVE-2006-4582: Undefined Security Weakness

Cross-site request forgery CSRF vulnerability in The Address Book 1.04e allows remote attackers to perform unauthorized actions as other users via unspecified vectors, as demonstrated by deleting arbitrary users via the id parameter in a deleteuser action in users.php...

CVE-2006-4579: Undefined Security Weakness

Directory traversal vulnerability in users.php in The Address Book 1.04e allows remote attackers to include arbitrary files via a .. dot dot in the language parameter...

CVE-2004-2669: Undefined Security Weakness

Multiple SQL injection vulnerabilities in Land Down Under LDU v701 allow remote attackers to execute arbitrary SQL commands or obtain the installation path via parameters including 1 s, w, and d in users.php, 2 id in comments.php, 3 rusername in auth.php, or 4 h in plug.php...

WEBInsta CMS <= 0.3.1 (users.php) Remote File Include Vulnerability

No description provided by source. / Vulnerable product : http://www.webinsta.com/download.html WEBInsta. CMS 0.3.1 Author : Yns - yns.zaxaz.com / Exploit: http://HOST/PATH/modules/usersonline/users.php?moduledir=REMOTEFILE...

CVE-2006-6268: Undefined Security Weakness

SQL injection vulnerability in system/core/profile/profile.inc.php in Neocrome Land Down Under LDU 8.x and earlier allows remote authenticated users to execute arbitrary SQL commands via a url-encoded id parameter to users.php that begins with a valid filename, as demonstrated by "default.gif"...

CVE-2006-6177: Undefined Security Weakness

SQL injection vulnerability in system/core/users/users.profile.inc.php in Neocrome Seditio 1.10 and earlier allows remote authenticated users to execute arbitrary SQL commands via a double-url-encoded id parameter to users.php that begins with a valid filename, as demonstrated by "default.gif"...