vBulletin < 2.3.6, 3.0.x < 3.0.6 XSS Vulnerability

vBulletin is vulnerable to a cross-site scripting XSS issue, due to a failure of the application to properly sanitize user-supplied URI input. SPDX-FileCopyrightText: 2005 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective rig...

vBulletin 'last10.php' SQLi Vulnerability - Active Check

The installed version of last10.php may allow an attacker to cause an SQL injection SQLi vulnerability allowing an attacker to cause the program to execute arbitrary SQL statements. SPDX-FileCopyrightText: 2004 Noam Rathaus Some text descriptions might be excerpted from a referenced sources, and...

vBulletin 'Calendar' Command Execution Vulnerability (CVE-2001-0475) - Active Check

A vulnerability in vBulletin enables attackers to craft special URLs that will execute commands on the server through the vBulletin PHP script. SPDX-FileCopyrightText: 2005 SecurITeam Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...

vBulletin's Calendar Command Execution Vulnerability

A vulnerability in vBulletin enables attackers to craft special URLs that will execute commands on the server through the vBulletin PHP script. For more information see: http://www.securiteam.com/securitynews/5IP0B203PI.html OpenVAS Vulnerability Test $Id: vbulletincalendercommandexecution.nasl...

vBulletin XSS(2)

The remote host is running vBulletin, a web based bulletin board system written in PHP. The remote version of this software seems to be prior or equal to version 2.2.9. These versions are vulnerable to a cross-site scripting issue, due to a failure of the application to properly sanitize...

vBulletin Detection (HTTP)

HTTP based detection of vBulletin. SPDX-FileCopyrightText: 2005 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.17282";...

vBulletin < 3.0.2 XSS Vulnerability

The remote version of vBulletin is vulnerable to a cross-site scripting XSS issue, due to a failure of the application to properly sanitize user-supplied URI input. SPDX-FileCopyrightText: 2004 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C...

vBulletin < 3.0.5 'init.php' Unspecified Vulnerability

It is reported that versions 3.0.0 through to 3.0.4 of vBulletin are prone to a security flaw in SPDX-FileCopyrightText: 2005 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Subdreamer 2.2.1 SQL Injection / Command Execution Exploit

Exploit for unknown platform in category web applications ========================================================== Subdreamer 2.2.1 SQL Injection / Command Execution Exploit ========================================================== !/usr/bin/perl Subdreamer 2.2.1 command exec exploit...

Subdreamer 2.2.1 - SQL Injection / Command Execution

!/usr/bin/perl Subdreamer 2.2.1 command exec exploit @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ supported targets: without forum integration with phpBB2 integration with ipb2 integration with vbulletin2 integration...

20050917-vbulletin-3.0.8.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 --------------------------------------------------- | BuHa Security-Advisory 3 | Sep 17th, 2005 | | feat. SePro Bugtraq | | --------------------------------------------------- | Vendor | vBulletin | | URL | http://vbulletin.com/ | | Version | =...

CVE-2005-3023

Multiple cross-site scripting XSS vulnerabilities in vBulletin 3.0.9 and earlier allow remote attackers to inject arbitrary web script or HTML via certain arguments to 1 announcement.php, 2 admincalendar.php, 3 bbcode.php, 4 cronadmin.php, 5 email.php, 6 faq.php, 7 forum.php, 8 image.php, 9...

CVE-2005-3025

Multiple cross-site scripting XSS vulnerabilities in vBulletin 3.0.7 and earlier allow remote attackers to inject arbitrary web script or HTML via the loc parameter to 1 modcp/index.php or 2 admincp/index.php, or the ip parameter to 3 modcp/user.php or 4 admincp/usertitle.php...

CVE-2005-3024

Multiple SQL injection vulnerabilities in vBulletin 3.0.7 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 announcement parameter to announcement.php, the 2 threadforumid or 3 criteria parameters to thread.php, 4 userid parameter to user.php, the 5...

CVE-2005-3019

Multiple SQL injection vulnerabilities in vBulletin before 3.0.9 allow remote attackers to execute arbitrary SQL commands via the 1 request parameter to joinrequests.php, 2 limitnumber or 3 limitstart to user.php, 4 usertitle.php, or 5 usertools.php...

CVE-2005-3020

Multiple cross-site scripting XSS vulnerabilities in vBulletin before 3.0.9 allow remote attackers to inject arbitrary web script or HTML via the 1 group parameter to css.php, 2 redirect parameter to index.php, 3 email parameter to user.php, 4 goto parameter to language.php, 5 orderby parameter t...

CVE-2005-3021

image.php in vBulletin 3.0.9 and earlier allows remote attackers with access to the administrator panel to upload arbitrary files via the upload action...

CVE-2005-3022

Multiple SQL injection vulnerabilities in vBulletin 3.0.9 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 announcement parameter to announcement.php, 2 userid parameter to user.php, 3 calendar parameter to admincalendar.php, 4 cronid parameter to cronlog.php, 5...

CVE-2005-3022

Multiple SQL injection vulnerabilities in vBulletin 3.0.9 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 announcement parameter to announcement.php, 2 userid parameter to user.php, 3 calendar parameter to admincalendar.php, 4 cronid parameter to cronlog.php, 5...

CVE-2005-3020

Multiple cross-site scripting XSS vulnerabilities in vBulletin before 3.0.9 allow remote attackers to inject arbitrary web script or HTML via the 1 group parameter to css.php, 2 redirect parameter to index.php, 3 email parameter to user.php, 4 goto parameter to language.php, 5 orderby parameter t...