CVE-2007-0076

Openforum stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing user passwords via a direct request for openforum.mdb...

Improper access control

Openforum stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing user passwords via a direct request for openforum.mdb...

Improper access control

AspBB stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing user passwords via a direct request for db/aspbb.mdb...

CVE-2007-0078

BattleBlog stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for database/blankmaster.mdb...

Improper access control

BattleBlog stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for database/blankmaster.mdb...

CVE-2007-0078

BattleBlog stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for database/blankmaster.mdb...

CVE-2007-0079

rblog stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for 1 data/admin.mdb or 2 data/rblog.mdb...

CVE-2007-0075

AspBB stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing user passwords via a direct request for db/aspbb.mdb...

CVE-2007-0079

CVE-2007-0079 describes a vulnerability in a web application (rblog) where sensitive data files are stored under the web root with insufficient access control. An attacker can directly download the databases (data/admin.mdb and data/rblog.mdb) via HTTP requests, leading to complete data disclosur...

CVE-2006-6866

STphp EasyNews PRO 4.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain usernames, email addresses, and password hashes via a direct request for data/users.txt...

CVE-2006-6888

P-News 1.16 and 1.17 store sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the administrative account name and password hash via a direct request for db/user.dat...

CVE-2006-6890

Voodoo chat 1.0RC1b stores sensitive information under the web root with insufficient access control, which allows remote attackers to download passwords via a direct request for data/users.dat...

CVE-2006-6825

Calendar MX BASIC 1.0.2 and earlier store sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for calendar.mdb. NOTE: The provenance of this information is unknown; the details are obtained solely fro...

CVE-2006-6463

Unrestricted file upload vulnerability in admin/add.php in Midicart allows remote authenticated users to upload arbitrary .php files, and possibly other files, to the images/ directory under the web root...

CVE-2006-6463

Unrestricted file upload vulnerability in admin/add.php in Midicart allows remote authenticated users to upload arbitrary .php files, and possibly other files, to the images/ directory under the web root...

CVE-2006-6463

The CVE-2006-6463 entry concerns Midicart’s admin/add.php, where an unrestricted file upload vulnerability exists. According to PT-2006-7072, remote authenticated users can upload arbitrary files (potentially including .php) to the images/ directory under the web root via the admin/add.php endpoi...

phpMyAdminexport.php文件泄露漏洞

phpMyAdmin是一个免费工具，为管理MySQL提供了一个WWW管理接口。phpMyAdmin包含的'export.php'脚本对用户提交参数缺少充分过滤，远程攻击者可以利用这个漏洞进行目录遍历攻击。phpMyAdmin包含的'export.php'脚本对用户提交给'what'的参数缺少充分过滤，远程攻击者提交包含多个'../'字符的数据，可绕过WEB ROOT限制，以WEB权限查看系统上的任意文件信息。 phpMyAdmin2.5-2.5.5-pl1 phpMyAdmin...

CVE-2006-6378

BTSaveMySql 1.2 stores sensitive data under the web root with insufficient access control, which allows remote attackers to obtain configuration and save files via direct requests...

CVE-2006-6351

KhaledMuratList stores sensitive data under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for 1 CL2F9R1A2C1N.mdb or 2 Data2F9R1A2C1N.mdb...

CVE-2006-6350

listpics 5 stores sensitive data under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for listpics.mdb...