Xoops多个跨站脚本漏洞(CSS/XSS) Exploit

No description provided by source. http://xoops/modules/newbb/edit.php?forum=1&topicid=1&viewmode=flat&order=ASC"scriptalertdocument.cookie/script&postid=1 http://xoops/modules/repository/commentedit.php?comitemid=1&comorder=0&commode=flat&cid=1&cid=1"scriptalertdocument.cookie/script&comid=1...

CVE-2006-5810

Affected software : XOOPS 1.0, module wfdownloads, endpoint /modules/wfdownloads/newlist.php. Vulnerability : Cross-site scripting (XSS) via the parameter newdownloadshowdays . The root cause is manipulation of user-supplied input in the vulnerable script, allowing injection of arbitrary web scri...

CVE-2006-5810

Cross-site scripting XSS vulnerability in modules/wfdownloads/newlist.php in XOOPS 1.0 allows remote attackers to inject arbitrary web script or HTML via the newdownloadshowdays parameter...

PT-2006-6487 · Xoops · Xoops

Name of the Vulnerable Software and Affected Versions: XOOPS version 1.0 Description: A cross-site scripting issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the newdownloadshowdays parameter in the /modules/wfdownloads/newlist.php endpoint...

CVE-2006-5810: Undefined Security Weakness

Cross-site scripting XSS vulnerability in modules/wfdownloads/newlist.php in XOOPS 1.0 allows remote attackers to inject arbitrary web script or HTML via the newdownloadshowdays parameter...

Xoops 2.0.5 - NewList.php Cross-Site Scripting

Xoops 2.0.5 - NewList.php Cross-Site Scripting source: https://www.securityfocus.com/bid/20927/info Xoops is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code execute in the...

Xoops 2.0.5 - 'NewList.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/20927/info Xoops is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of...

[Full-disclosure] Cross Site Scripting (XSS) Vulnerability in Netquery by "VIRtech"

·= Security Advisory =· Issue: Cross Site Scripting XSS Vulnerability in Netquery by "VIRtech" Discovered Date: 04/10/2006 Author: Tal Argoni, LegendaryZion. talargoni at gmail.com Product Vendor: http://www.virtech.org Details: VIRtechs Netquery system is prone to a Cross Site Scripting...

Cross Site Scripting (XSS) Vulnerability in Netquery by "VIRtech"

·= Security Advisory =· Issue: Cross Site Scripting XSS Vulnerability in Netquery by "VIRtech" Discovered Date: 04/10/2006 Author: Tal Argoni, LegendaryZion. talargoni at gmail.com Product Vendor: http://www.virtech.org Details: VIRtechs Netquery system is prone to a Cross Site Scripting...

RMSOFT-xss.txt

Cross Site Scripting In RMSOFT Catalogo de Imagenes URL: modules/rmgs/images.php?kw=alertdocument.cookie&q=search Google Dork: allinurl: /modules/rmgs/ Potenciado for XOOPS All Versions Greetz: ANtrAX,HANOWARS,4UREV01R & WWW.C-GROUP.ORG...

Xoops 2.2.3 - search.php Cross-Site Scripting

Xoops 2.2.3 - search.php Cross-Site Scripting source: https://www.securityfocus.com/bid/20514/info Xoops is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code execute in the...

Xoops 2.2.3 - 'search.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/20514/info Xoops is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of...

CVE-2006-4417

SQL injection vulnerability in edituser.php in Xoops before 2.0.15 allows remote attackers to execute arbitrary SQL commands via the useravatar parameter...

CVE-2006-4417

SQL injection vulnerability in edituser.php in Xoops before 2.0.15 allows remote attackers to execute arbitrary SQL commands via the useravatar parameter...

CVE-2006-4417

XOOPS contains a SQL injection vulnerability (CVE-2006-4417) in edituser.php via the user_avatar parameter, affecting XOOPS prior to version 2.0.15. The issue allows remote attackers to execute arbitrary SQL commands; no exploitation details are provided in the documents. The public references in...

CVE-2006-4417: Undefined Security Weakness

SQL injection vulnerability in edituser.php in Xoops before 2.0.15 allows remote attackers to execute arbitrary SQL commands via the useravatar parameter...

Sql injection in Xoops

Hi, There is a sql injection in Xoops 2.0.14 and maybe before versions . One of the user inputs, is used in the sql query without proper checking : File /edituser.php, Line 347 : :: if !empty$POST'useravatar' $useravatar = trim$POST'useravatar'; :: $criteriaavatar = new CriteriaComponew...

SQL-Injection in xoops myAds module

Advisory : SQL-Injection in xoops myAds module Home Page: http://www.xoops.org/ Уязвимость/Vulnerability: SQL-injection Уязвимый скрипт/Vulnerable script: annonces-p-f.php...

CVE-2006-3363

PHP remote file inclusion vulnerability in index.php in the Glossaire module 1.7 for Xoops allows remote attackers to execute arbitrary PHP code via a URL in the pa parameter...

CVE-2006-3363

The CVE-2006-3363 entry documents a PHP Remote File Inclusion vulnerability in the Glossaire module 1.7 for XOOPS. The flaw enables remote attackers to execute arbitrary PHP code via a URL supplied in the pa parameter, impacting the module’s normal handling of file inclusion. The NVD record lists...