PT-2007-1673 · Geobb · Geobb

Name of the Vulnerable Software and Affected Versions: GeoBB Georgian Bulletin Board versions prior to 1.0 Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the action parameter in the index.php file. However, it's noted that GeoBB 1.0 sets $action to a...

Sql injection

Multiple eval injection vulnerabilities in iGeneric iG Shop 1.0 allow remote attackers to execute arbitrary code via the action parameter, which is supplied to an eval function call in 1 cart.php and 2 page.php. NOTE: a later report and CVE analysis indicate that the vulnerability is present in 1...

CVE-2007-0134: Improper Control of Generation of Code

Multiple eval injection vulnerabilities in iGeneric iG Shop 1.0 allow remote attackers to execute arbitrary code via the action parameter, which is supplied to an eval function call in 1 cart.php and 2 page.php. NOTE: a later report and CVE analysis indicate that the vulnerability is present in 1...

CVE-2006-6087

Cross-site scripting XSS vulnerability in weblog.php in my little weblog allows remote attackers to inject arbitrary web script or HTML via the action parameter...

CVE-2006-6087

The CVE-2006-6087 entry concerns XSS in weblog.php of the My Little Weblog project, allowing remote attackers to inject arbitrary script/HTML via the action parameter. The vulnerability is located in weblog.php and is triggered by crafting the action parameter to include script/HTML. The connecte...

CVE-2006-6087: Undefined Security Weakness

Cross-site scripting XSS vulnerability in weblog.php in my little weblog allows remote attackers to inject arbitrary web script or HTML via the action parameter...

CVE-2006-6032

SPHPBlog (Simple PHP Blog) is affected by XSS in CVE-2006-6032. Concrete details from the connected data show vulnerable code paths in SPHPBlog where input is used without proper validation for two parameters: the action parameter in add_block.php and the entry parameter in index.php. The descrip...

My Little Weblog 2006.11.21 - Weblog.php Cross-Site Scripting

My Little Weblog 2006.11.21 - Weblog.php Cross-Site Scripting source: https://www.securityfocus.com/bid/21238/info My Little Weblog is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input to the 'action' parameter of the 'weblog.php' script...

PT-2006-6339 · Ig · Ig Shop

Name of the Vulnerable Software and Affected Versions: iG Shop version 1.4 Description: The issue is related to a cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary web script or HTML via arbitrary query strings in the change pass.php file when the action...

CVE-2006-5631: Undefined Security Weakness

Cross-site scripting XSS vulnerability in changepass.php in iG Shop 1.4 allows remote attackers to inject arbitrary web script or HTML via arbitrary query strings when the action parameter is not "1", as demonstrated using script in the action parameter, a different vulnerability than CVE-2006-56...

CVE-2006-5503

Cross-site scripting XSS vulnerability in index.php in Simple Machines Forum SMF 1.1 RC2 allows remote attackers to inject arbitrary web script or HTML via the action parameter...

CVE-2006-5504

Cross-site scripting XSS vulnerability in index.php in Simple Machines Forum SMF allows remote attackers to inject arbitrary web script or HTML via a base64 encoded params value in the action parameter...

CVE-2006-5504: Undefined Security Weakness

Cross-site scripting XSS vulnerability in index.php in Simple Machines Forum SMF allows remote attackers to inject arbitrary web script or HTML via a base64 encoded params value in the action parameter...

CVE-2006-5503: Undefined Security Weakness

Cross-site scripting XSS vulnerability in index.php in Simple Machines Forum SMF 1.1 RC2 allows remote attackers to inject arbitrary web script or HTML via the action parameter...

CVE-2006-5447

Cross-site scripting XSS vulnerability in index.php in DEV Web Management System WMS 1.5 allows remote attackers to inject arbitrary web script or HTML via the action parameter...

CVE-2006-5447: Undefined Security Weakness

Cross-site scripting XSS vulnerability in index.php in DEV Web Management System WMS 1.5 allows remote attackers to inject arbitrary web script or HTML via the action parameter...

CVE-2006-4752: Undefined Security Weakness

Laurentiu Matei eXpandable Home Page XHP CMS 0.5.1 allows remote attackers to obtain the installation path via a query to the engine module, probably with an invalid action parameter...

CVE-2006-4543

Cross-site scripting XSS vulnerability in index.php in HLStats 1.34 allows remote attackers to inject arbitrary web script or HTML via the 1 game parameter in players mode, the 2 weapon parameter in weaponinfo mode, the 3 st parameter in search mode, the 4 action parameter in actioninfo mode, and...

CVE-2006-4543: Undefined Security Weakness

Cross-site scripting XSS vulnerability in index.php in HLStats 1.34 allows remote attackers to inject arbitrary web script or HTML via the 1 game parameter in players mode, the 2 weapon parameter in weaponinfo mode, the 3 st parameter in search mode, the 4 action parameter in actioninfo mode, and...

CVE-2006-3138

Multiple cross-site scripting XSS vulnerabilities in phpMyDirectory 10.4.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 PIC parameter in offers-pix.php, 2 from parameter in cp/index.php, and 3 action parameter in cp/adminindex.php...