PT-2005-1856 · Php · Php

Name of the Vulnerable Software and Affected Versions: RUNCMS version 1.1A Ciamos version 0.9.2 RC1 e-Xoops version 1.05 Rev3 Description: The issue allows remote attackers to obtain sensitive information via an invalid parameter to the convertorderbytrans function, which reveals the path in a PH...

RunCMS 1.1 - Database Configuration Information Disclosure

RunCMS 1.1 - Database Configuration Information Disclosure source: https://www.securityfocus.com/bid/12848/info RunCMS is reportedly affected by an information disclosure vulnerability. This issue is due to a failure in the application to secure sensitive information. Exploitation of this...

CVE-2005-0743

The CVE describes an arbitrary PHP file upload flaw in XOOPS 2.0.9.2 and earlier, exploitable via the uploader.php feature because file extensions are not filtered. This allows remote attackers to upload and potentially execute PHP scripts, with impact on confidentiality, integrity, and availabil...

CVE-2005-0743

The custom avatar uploading feature uploader.php for XOOPS 2.0.9.2 and earlier allows remote attackers to upload arbitrary PHP scripts, whose file extensions are not filtered...

[SCAN Associates Security Advisory] xoops 2.0.9.2 and below weak file extension validation

Summary: xoops 2.0.9.2 and below weak file extension validation Description =========== XOOPS is an extensible, OO Object Oriented, easy to use dynamic web content management system written in PHP. XOOPS is the ideal tool for developing small to large dynamic community websites, intra company...

XOOPS Arbitrary Avatar File Upload

Binary data 2683.prm...

CVE-2004-1640

Multiple cross-site scripting XSS vulnerabilities in XOOPS 0.94 and 1.0 allow remote attackers to execute arbitrary web script and HTML via the 1 terme parameter to search.php or 2 letter parameter to letter.php...

CVE-2004-1640

The CVE-2004-1640 entry describes multiple cross-site scripting (XSS) vulnerabilities in XOOPS versions 0.94 and 1.0, exploitable via user-supplied input in two scripts: the terme parameter to search.php and the letter parameter to letter.php. The underlying issue is improper handling/sanitizatio...

Xoops Incontent Module Traversal Arbitrary PHP File Source Disclosure

The remote host is running Incontent, a third-party module for Xoops. The version of Incontent installed on the remote host fails to sanitize user-supplied input to the 'url' parameter of the 'modules/incontent/index.php' script before using it to read a file whose contents are returned. By passi...

[SA14064] Xoops Incontent Module Arbitrary File Content Disclosure

TITLE: Xoops Incontent Module Arbitrary File Content Disclosure SECUNIA ADVISORY ID: SA14064 VERIFY ADVISORY: http://secunia.com/advisories/14064/ CRITICAL: Moderately critical IMPACT: Exposure of sensitive information WHERE: From remote SOFTWARE: Incontent 3.x module for Xoops...

XOOPS Detection

Binary data 2580.prm...

XOOPS Module module 3.0 - Directory Traversal

source: https://www.securityfocus.com/bid/12406/info Xoops Incontent module is reported prone to a directory traversal vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied input. A malicious user could issue a request containing directory traversal...

CVE-2004-2756

Cross-site scripting XSS vulnerability in viewtopic.php in Xoops 2.x, possibly 2 through 2.0.5, allows remote attackers to inject arbitrary web script or HTML via the 1 forum and 2 topicid parameters...

XOOPS viewtopic.php Multiple Parameter XSS

The weblinks module of XOOPS contains a file named 'viewtopic.php' in the '/modules/newbb' directory. The code of the module insufficently filters out user provided data. The URL parameter used by 'viewtopic.php' can be used to insert malicious HTML and/or JavaScript in to the web page...

XOOPS <= 1.0 Dictionary Module Multiple Scripts XSS

The remote version of XOOPS is vulnerable to several cross-site scripting attacks. An attacker can exploit it using the 'terme' and 'letter' parameters of the 'search.php' and 'letter.php' scripts respectively. This can be used to take advantage of the trust between a client and server allowing t...

Cross Site Scripting in XOOPS Version 2.x Dictionary module

-------------------------------------------------------------------------- Cross Site Scripting in XOOPS Version 2.x Dictionary module -------------------------------------------------------------------------- Type: Cross Site Scripting XSS Titule: Xoops Dictionary module by nagl Date: August 28,...

Nagl Dictionary Module for XOOPS XSS

Binary data 2187.prm...

CVE-2004-1640

Multiple cross-site scripting XSS vulnerabilities in XOOPS 0.94 and 1.0 allow remote attackers to execute arbitrary web script and HTML via the 1 terme parameter to search.php or 2 letter parameter to letter.php...

Nagl XOOPS Dictionary Module 1.0 - Multiple Cross-Site Scripting Vulnerabilities

Nagl XOOPS Dictionary Module 1.0 - Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/11064/info Reportedly the XOOPS Dictionary Module by Nagle is affected by multiple cross-site scripting vulnerabilities. This issue is due to a failure of the application to...

Nagl XOOPS Dictionary Module 1.0 - Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/11064/info Reportedly the XOOPS Dictionary Module by Nagle is affected by multiple cross-site scripting vulnerabilities. This issue is due to a failure of the application to properly sanitize user-supplied URI input. As a result of this issue and attacker...