CVE-2006-6046: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in eggblog 3.1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 edit parameter to a admin/articles.php or b admin/comments.php, or the 2 add parameter to admin/users.php...

Eggblog 3.1 admin/users.php add Parameter XSS

Eggblog 3.1 admin/users.php add Parameter XSS. CVE-2006-6046. Webapps exploit for php platform source: http://www.securityfocus.com/bid/21134/info Eggblog is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage...

CVE-2006-4757

Multiple SQL injection vulnerabilities in the admin section in e107 0.7.5 allow remote authenticated administrative users to execute arbitrary SQL commands via the 1 linkopentype, 2 linkrender, 3 linkclass, and 4 linkid parameters in a links.php; the 5 searchquery parameter in b users.php; and th...

CVE-2006-4757: Undefined Security Weakness

Multiple SQL injection vulnerabilities in the admin section in e107 0.7.5 allow remote authenticated administrative users to execute arbitrary SQL commands via the 1 linkopentype, 2 linkrender, 3 linkclass, and 4 linkid parameters in a links.php; the 5 searchquery parameter in b users.php; and th...

Sql injections in e107 [Admin section]

Hi, There are several sql injections in e107 0.7.5 admin section : I The "linkopentype", "linkrender" and "linkclass" parameters are passed to "dbInsert" function without checking : File /e107admin/links.php, Line 496 : $sql-dbInsert"links", "0, '$linkname', '$linkurl', '$linkdescription',...

CVE-2006-4217: Undefined Security Weakness

PHP remote file inclusion vulnerability in modules/usersonline/users.php in WEBInsta CMS 0.3.1 allows remote attackers to execute arbitrary PHP code via a URL in the moduledir parameter, a different vulnerability than CVE-2006-4196. NOTE: the provenance of this information is unknown; the details...

WEBInsta CMS 0.3.1 - users.php Remote File Inclusion

WEBInsta CMS 0.3.1 - users.php Remote File Inclusion / Vulnerable product : http://www.webinsta.com/download.html WEBInsta. CMS 0.3.1 Author : Yns - yns.zaxaz.com / Exploit: http://HOST/PATH/modules/usersonline/users.php?moduledir=REMOTEFILE milw0rm.com 2006-08-15...

CVE-2006-3316

Multiple PHP remote file inclusion vulnerabilities in phpRaid 3.0.5 allow remote attackers to execute arbitrary code via a URL in the phpraiddir parameter to 1 logs.php and 2 users.php, a different set of vectors than CVE-2006-3116...

CVE-2006-3316: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in phpRaid 3.0.5 allow remote attackers to execute arbitrary code via a URL in the phpraiddir parameter to 1 logs.php and 2 users.php, a different set of vectors than CVE-2006-3116...

Vegadns blind sql injection and cross site scripting

Author : Ph03n1X email : [email protected] site : http://kandangjamur.net/ vendor : www.vegadns.org version: 0.99 XSS ---- PoC : http://exam.com/vegadns/index.php?VDNSSessid=m42644r75o1eg4f7mb7e4rnpg7&message=3Ch13E3Cmarquee3Ealoo3C/marquee3E3C/h13E Vulnerable script is located in index.php...

CVE-2006-1051: Undefined Security Weakness

SQL injection vulnerability in Akarru Social BookMarking Engine before 0.4.3.4 allows remote attackers to execute arbitrary SQL commands via unknown attack vectors, possibly involving the username parameter to akarru.lib/users.php...

CVE-2006-0823

Multiple SQL injection vulnerabilities in Geeklog 1.4.0 before 1.4.0sr1 and 1.3.11 before 1.3.11sr4 allow remote attackers to inject arbitrary SQL commands via the 1 userid variable to users.php or 2 sessid variable to lib-sessions.php...

CVE-2006-0823: Undefined Security Weakness

Multiple SQL injection vulnerabilities in Geeklog 1.4.0 before 1.4.0sr1 and 1.3.11 before 1.3.11sr4 allow remote attackers to inject arbitrary SQL commands via the 1 userid variable to users.php or 2 sessid variable to lib-sessions.php...

CVE-2005-4223: Undefined Security Weakness

Multiple "potential" SQL injection vulnerabilities in Utopia News Pro UNP 1.1.4 might allow remote attackers to execute arbitrary SQL commands via 1 the newsid parameter in editnews.php, 2 the catid and question parameters in faq.php, 3 the poster parameter in postnews.php, 4 the tempid parameter...

CVE-2005-3556: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in PHPlist 2.10.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 listname parameter in a admin/editlist.php, 2 title parameter in b admin/spageedit.php, 3 title field in c admin/template.php, 4 filter, 5 delete...

CVE-2005-2323

Multiple SQL injection vulnerabilities in Class-1 Forum 0.24.4 and 0.23.2, and Clever Copy with forums installed, allow remote attackers to modify SQL statements via the following parameters: (1) id in viewattach.php, (2) viewuser_id in users.php, and (3) id or (4) forum in viewforum.php. Affecte...

CVE-2005-2322: Undefined Security Weakness

Cross-site scripting XSS vulnerability in Class-1 Forum 0.24.4 and 0.23.2, and Clever Copy with forums installed, allows remote attackers to inject arbitrary web script or HTML via the 1 viewuserid or 2 group parameter to users.php...

CVE-2005-2323: Undefined Security Weakness

Multiple SQL injection vulnerabilities in Class-1 Forum 0.24.4 and 0.23.2, and Clever Copy with forums installed, allow remote attackers to modify SQL statements via the 1 id parameter to viewattach.php, 2 viewuserid parameter to users.php, or the 3 id or 4 forum parameter to viewforum.php...

CVE-2005-0305

CVE-2005-0305 affects Siteman 1.1.10 and earlier. A CRLF injection vulnerability in users.php, triggered via the line parameter in a docreate operation, allows remote attackers with valid credentials to create arbitrary user accounts and gain privileges (administrative access). The root cause is ...

CVE-2005-0305: Undefined Security Weakness

CRLF injection vulnerability in users.php in Siteman 1.1.10 and earlier allows remote attackers to add arbitrary users and gain privileges via the line parameter in a docreate operation...