1087 matches found
Cross site scripting
Cross-site scripting XSS vulnerability in superalbum/index.php in Photoalbum B&W 1.3 allows remote attackers to inject arbitrary web script or HTML via the pic parameter...
CVE-2006-2729
Cross-site scripting XSS vulnerability in superalbum/index.php in Photoalbum B&W 1.3 allows remote attackers to inject arbitrary web script or HTML via the gal parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...
CVE-2006-2728
Cross-site scripting XSS vulnerability in superalbum/index.php in Photoalbum B&W 1.3 allows remote attackers to inject arbitrary web script or HTML via the pic parameter...
CVE-2006-2728
CVE-2006-2728 is an XSS flaw in Photoalbum B&W 1.3, specifically in the file superalbum/index.php. The vulnerability arises when an attacker supplies a crafted value for the pic parameter, enabling the injection of arbitrary web script or HTML. Documents identify the affected component but do not...
CVE-2006-2729
The CVE-2006-2729 entry details a cross-site scripting (XSS) vulnerability in the Photoalbum B&W 1.3 package, specifically in the file as superalbum/index.php, where the gal parameter can be abused to inject arbitrary script or HTML. The affected component is the web application’s index handler ...
CVE-2006-2728
Cross-site scripting XSS vulnerability in superalbum/index.php in Photoalbum B&W 1.3 allows remote attackers to inject arbitrary web script or HTML via the pic parameter...
CVE-2006-2729
Cross-site scripting XSS vulnerability in superalbum/index.php in Photoalbum B&W 1.3 allows remote attackers to inject arbitrary web script or HTML via the gal parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...
CVE-2006-2728: Undefined Security Weakness
Cross-site scripting XSS vulnerability in superalbum/index.php in Photoalbum B&W 1.3 allows remote attackers to inject arbitrary web script or HTML via the pic parameter...
CVE-2006-2729: Undefined Security Weakness
Cross-site scripting XSS vulnerability in superalbum/index.php in Photoalbum B&W 1.3 allows remote attackers to inject arbitrary web script or HTML via the gal parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...
Xss exploit in Photoalbum B&W v1.3
Xss exploit in Photoalbum B&W v1.3 forum type : Photoalbum B&W v1.3 bug found by : black-code & sweet-devil team : site-down type : Xss exploit : http://www.example.com/superalbum/index.php?pic='scriptalert10/script path to admin login: emails: [email protected] & [email protected] All my...
Photoalbum BW 1.3 - index.php Cross-Site Scripting
Photoalbum BW 1.3 - index.php Cross-Site Scripting source: https://www.securityfocus.com/bid/18142/info Photoalbum B&W is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue ...
Photoalbum B&W 1.3 - 'index.php' Cross-Site Scripting
source: https://www.securityfocus.com/bid/18142/info Photoalbum B&W is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code execute in the browse...
CVE-2006-2228
CVE-2006-2228 affects w-Agora (Web-Agora) 4.2.0 with a cross-site scripting (XSS) flaw: a BBCode tag containing a JavaScript event name followed by whitespace before the = character bypasses the regex intended to remove onmouseover/events, enabling remote script execution. The provided documents ...
CVE-2006-2228: Undefined Security Weakness
Cross-site scripting XSS vulnerability in w-Agora aka Web-Agora 4.2.0 allows remote attackers to inject arbitrary web script or HTML via a post with a BBCode tag that contains a JavaScript event name followed by whitespace before the '=' equals character, which bypasses a restrictive regular...
W-Agora 4.20 XSS
PLEASE NOTE: I am not sure if HTML is an option. I looked through the Administration panel and did not see an option for it, and the fact that there is no BBcode leads me to believe that this is the method of BBCode/etc. W-Agora is a fairly 'nice' bulletin board written in PHP. It allows multiple...
W-Agora 4.2 - BBCode Script Injection
W-Agora 4.2 - BBCode Script Injection source: https://www.securityfocus.com/bid/17751/info W-Agora is prone to a script-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before including it in dynamically generated content. W-Agora...
W-Agora 4.2 - BBCode Script Injection
source: https://www.securityfocus.com/bid/17751/info W-Agora is prone to a script-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before including it in dynamically generated content. W-Agora can be configured to send all user...
W-Agora 'site' Parameter Directory Traversal Vulnerability
W-Agora is prone to directory traversal attacks. SPDX-FileCopyrightText: 2005 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:w-agora:w-agora"; ifdescriptio...
CVE-2002-2128
editform.php in w-Agora 4.1.5 allows local users to execute arbitrary PHP code via .. dot dot sequences in the file parameter...
CVE-2002-2129
CVE-2002-2129 : Cross-site scripting (XSS) in editform.php of w-Agora 4.1.5. The vulnerability occurs when an arbitrary form field name containing script is echoed back during form display, allowing remote script execution in the user’s browser. The provided documents describe the affected softwa...