1177 matches found
Photoalbum BW 1.3 - index.php Cross-Site Scripting
Photoalbum BW 1.3 - index.php Cross-Site Scripting source: https://www.securityfocus.com/bid/18142/info Photoalbum B&W is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue ...
Photoalbum B&W 1.3 - 'index.php' Cross-Site Scripting
source: https://www.securityfocus.com/bid/18142/info Photoalbum B&W is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code execute in the browse...
CVE-2006-2228
CVE-2006-2228 affects w-Agora (Web-Agora) 4.2.0 with a cross-site scripting (XSS) flaw: a BBCode tag containing a JavaScript event name followed by whitespace before the = character bypasses the regex intended to remove onmouseover/events, enabling remote script execution. The provided documents ...
CVE-2006-2228: Undefined Security Weakness
Cross-site scripting XSS vulnerability in w-Agora aka Web-Agora 4.2.0 allows remote attackers to inject arbitrary web script or HTML via a post with a BBCode tag that contains a JavaScript event name followed by whitespace before the '=' equals character, which bypasses a restrictive regular...
W-Agora 4.20 XSS
PLEASE NOTE: I am not sure if HTML is an option. I looked through the Administration panel and did not see an option for it, and the fact that there is no BBcode leads me to believe that this is the method of BBCode/etc. W-Agora is a fairly 'nice' bulletin board written in PHP. It allows multiple...
W-Agora 4.2 - BBCode Script Injection
W-Agora 4.2 - BBCode Script Injection source: https://www.securityfocus.com/bid/17751/info W-Agora is prone to a script-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before including it in dynamically generated content. W-Agora...
W-Agora 4.2 - BBCode Script Injection
source: https://www.securityfocus.com/bid/17751/info W-Agora is prone to a script-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before including it in dynamically generated content. W-Agora can be configured to send all user...
W-Agora 'site' Parameter Directory Traversal Vulnerability
W-Agora is prone to directory traversal attacks. SPDX-FileCopyrightText: 2005 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:w-agora:w-agora"; ifdescriptio...
CVE-2002-2128
editform.php in w-Agora 4.1.5 allows local users to execute arbitrary PHP code via .. dot dot sequences in the file parameter...
CVE-2002-2128
CVE-2002-2128 affects editform.php in w-Agora 4.1.5, enabling local users to run arbitrary PHP code via .. sequences in the file parameter (path traversal). Documented by NVD and Red Hat/CVE listings; CVSSv2 base score 4.6 (LOCAL access, LOW attack complexity, PARTIAL confidentiality/integrity/av...
CVE-2002-2129
Cross-site scripting vulnerability XSS in editform.php for w-Agora 4.1.5 allows remote attackers to execute arbitrary web script via an arbitrary form field name containing the script, which is echoed back to the user when displaying the form...
CVE-2002-2129
CVE-2002-2129 : Cross-site scripting (XSS) in editform.php of w-Agora 4.1.5. The vulnerability occurs when an arbitrary form field name containing script is echoed back during form display, allowing remote script execution in the user’s browser. The provided documents describe the affected softwa...
CVE-2002-2128: Undefined Security Weakness
editform.php in w-Agora 4.1.5 allows local users to execute arbitrary PHP code via .. dot dot sequences in the file parameter...
CVE-2002-2129: Undefined Security Weakness
Cross-site scripting vulnerability XSS in editform.php for w-Agora 4.1.5 allows remote attackers to execute arbitrary web script via an arbitrary form field name containing the script, which is echoed back to the user when displaying the form...
W-Agora 'file' Parameter Directory Traversal Vulnerability
W-Agora is prone to directory traversal attacks. SPDX-FileCopyrightText: 2004 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:w-agora:w-agora"; ifdescriptio...
[SA17201] W-Agora Local File Inclusion and File Upload Vulnerabilities
TITLE: W-Agora Local File Inclusion and File Upload Vulnerabilities SECUNIA ADVISORY ID: SA17201 VERIFY ADVISORY: http://secunia.com/advisories/17201/ CRITICAL: Highly critical IMPACT: Exposure of sensitive information, System access WHERE: From remote SOFTWARE: W-Agora 4.x...
w-Agora <= 4.2.0 Multiple Vulnerabilities
The version of w-Agora installed on the remote host fails to validate files uploaded with the 'browseavatar.php' and 'insert.php' scripts, which allows an attacker to upload scripts with arbitrary PHP code and then to execute it subject to the privileges of the web server user id. In addition, it...
wagora420_xpl.txt
W-agora 4.2.0 Remote code execution / cross site scripting poc exploit software: site: http://w-agora.net/en/index.php description: "W-Agora is a web publishing and forum software. It allows you and your visitors to store and display messages, files, share discussions and other information on you...
w-Agora <= 4.2.0 (quicklist.php) Remote Code Execution Exploit
Exploit for unknown platform in category web applications ============================================================== w-Agora = 4.2.0 quicklist.php Remote Code Execution Exploit ============================================================== ?php --- wagora420xpl.php 13.33 14/10/2005 W-Agora...
w-Agora <= 4.2.0 (quicklist.php) Remote Code Execution Exploit
No description provided by source. ?php --- wagora420xpl.php 13.33 14/10/2005 W-Agora 4.2.0 possibly prior versions Remote commands execution through quicklist.php and/or upload features by rgod site: http://rgod.altervista.org make these changes in php.ini if you have troubles to launch this...