336 matches found
CVE-2007-4141
OpenRat CMS 0.8-beta1 and earlier allows remote attackers to obtain sensitive information via a request containing an XSS sequence in the action parameter to index.php, which reveals the path in an error message...
CVE-2007-2812
Cross-site scripting XSS vulnerability in hlstats.php in HLstats 1.35, and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via 1 the PATHINFO or 2 the action parameter...
CVE-2007-2812
Cross-site scripting XSS vulnerability in hlstats.php in HLstats 1.35, and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via 1 the PATHINFO or 2 the action parameter...
CVE-2006-7036
PHP remote file inclusion vulnerability in register.php for Andys Chat 4.5 allows remote attackers to execute arbitrary code via the action parameter. NOTE: this issue was announced by an unreliable researcher, but the vendor is no longer distributing the product, so the original claims can not b...
CVE-2006-6941
index.php in FreeWebshop 2.2.2 and earlier allows remote attackers to obtain sensitive information via an invalid action parameter in an info operation, which discloses the path in an error message...
Remote file inclusion
PHP remote file inclusion vulnerability in index.php in GeoBB Georgian Bulletin Board allows remote attackers to execute arbitrary PHP code via a URL in the action parameter. NOTE: CVE disputes this issue, since GeoBB 1.0 sets $action to a whitelisted value...
PT-2007-1673 · Geobb · Geobb
Name of the Vulnerable Software and Affected Versions: GeoBB Georgian Bulletin Board versions prior to 1.0 Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the action parameter in the index.php file. However, it's noted that GeoBB 1.0 sets $action to a...
Sql injection
Multiple eval injection vulnerabilities in iGeneric iG Shop 1.0 allow remote attackers to execute arbitrary code via the action parameter, which is supplied to an eval function call in 1 cart.php and 2 page.php. NOTE: a later report and CVE analysis indicate that the vulnerability is present in 1...
CVE-2006-6087
Cross-site scripting XSS vulnerability in weblog.php in my little weblog allows remote attackers to inject arbitrary web script or HTML via the action parameter...
CVE-2006-6087
The CVE-2006-6087 entry concerns XSS in weblog.php of the My Little Weblog project, allowing remote attackers to inject arbitrary script/HTML via the action parameter. The vulnerability is located in weblog.php and is triggered by crafting the action parameter to include script/HTML. The connecte...
CVE-2006-6032
SPHPBlog (Simple PHP Blog) is affected by XSS in CVE-2006-6032. Concrete details from the connected data show vulnerable code paths in SPHPBlog where input is used without proper validation for two parameters: the action parameter in add_block.php and the entry parameter in index.php. The descrip...
My Little Weblog 2006.11.21 - Weblog.php Cross-Site Scripting
My Little Weblog 2006.11.21 - Weblog.php Cross-Site Scripting source: https://www.securityfocus.com/bid/21238/info My Little Weblog is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input to the 'action' parameter of the 'weblog.php' script...
PT-2006-6339 · Ig · Ig Shop
Name of the Vulnerable Software and Affected Versions: iG Shop version 1.4 Description: The issue is related to a cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary web script or HTML via arbitrary query strings in the change pass.php file when the action...
CVE-2006-5504
Cross-site scripting XSS vulnerability in index.php in Simple Machines Forum SMF allows remote attackers to inject arbitrary web script or HTML via a base64 encoded params value in the action parameter...
CVE-2006-5503
Cross-site scripting XSS vulnerability in index.php in Simple Machines Forum SMF 1.1 RC2 allows remote attackers to inject arbitrary web script or HTML via the action parameter...
CVE-2006-5447
Cross-site scripting XSS vulnerability in index.php in DEV Web Management System WMS 1.5 allows remote attackers to inject arbitrary web script or HTML via the action parameter...
CVE-2006-4543
Cross-site scripting XSS vulnerability in index.php in HLStats 1.34 allows remote attackers to inject arbitrary web script or HTML via the 1 game parameter in players mode, the 2 weapon parameter in weaponinfo mode, the 3 st parameter in search mode, the 4 action parameter in actioninfo mode, and...
CVE-2006-3138
Multiple cross-site scripting XSS vulnerabilities in phpMyDirectory 10.4.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 PIC parameter in offers-pix.php, 2 from parameter in cp/index.php, and 3 action parameter in cp/adminindex.php...