fipsCMS light - vulnerable to script injection.

fipsCMS lights is a freeware product of fipsasp.com. If you log on as admin, you can generate new pages in the CMS system. If you inject the "headline" field with scriptingcode like scriptalert‘code executed’/script, this will automaticly launch when a users visits that site. Please credit to:...

CVE-2005-3384

SQL injection vulnerability in Techno Dreams Guest Book script allows remote attackers to execute arbitrary SQL commands and bypass authentication via the userid parameter in admin/login.asp...

SQL injection in mediabox404 v1.2

Product: mediabox404 WebRadio & WebTV manager Version: 1.2 Release and previous URL: http://www.mediabox404.org VULNERABILITY CLASS: SQL injection PRODUCT DESCRIPTION This is a group of modulesadministration, client, programmation, diffusion in PHP/MySQL database that allows a webradio to manage...

PHPFreeNews 1.x - Admin Login SQL Injection

PHPFreeNews 1.x - Admin Login SQL Injection source: https://www.securityfocus.com/bid/14442/info PHPFreeNews is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful...

PHPFreeNews 1.x - Admin Login SQL Injection

source: https://www.securityfocus.com/bid/14442/info PHPFreeNews is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation could result in a compromise of the...

CVE-2005-1780

CVE-2005-1780 is a SQL injection flaw in Active News Manager, specifically in admin/login.asp, where the password field can be manipulated to execute arbitrary SQL commands. The vulnerability allows remote attackers to compromise data confidentiality and integrity. Documents indicate affected sof...

PT-2005-2748 · Unknown · Activenews Manager

Name of the Vulnerable Software and Affected Versions: Active News Manager affected versions not specified Description: The issue allows remote attackers to execute arbitrary SQL commands via the password variable in the "admin/login.asp" API endpoint. This could potentially lead to unauthorized...

CVE-2005-1786

SQL injection vulnerability in admin.asp in FunkyASP AD System 1.1 allows remote attackers to execute arbitrary SQL commands and gain privileges via the password parameter...

PT-2005-2552 · Asp · Asp Virtual News Manager

Name of the Vulnerable Software and Affected Versions: ASP Virtual News Manager affected versions not specified Description: The issue allows remote attackers to execute arbitrary SQL commands via the password parameter in the admin login.asp file. This can be exploited by sending malicious input...

CVE-2005-1419

SQL injection vulnerability in the admin login panel for Ocean12 Mailing List Manager 1.06 allows remote attackers to execute arbitrary SQL commands via the Adminid parameter...

CVE-2005-1419

SQL injection vulnerability in the admin login panel for Ocean12 Mailing List Manager 1.06 allows remote attackers to execute arbitrary SQL commands via the Adminid parameter...

[SA15173] enVivo!CMS SQL Injection Vulnerabilities

---------------------------------------------------------------------- Want a new IT Security job? Vacant positions at Secunia: http://secunia.com/secuniavacancies/ ---------------------------------------------------------------------- TITLE: enVivo!CMS SQL Injection Vulnerabilities SECUNIA...

[HSC Security Group] Ocean12 Mailing List Manager Pro SQL injection

Hackers Center Security Group http://www.hackerscenter.com/ Zinho's Security Advisory Desc: SQL injection : Ocean12 Mailing list manager PRO 1.06 Vendor: www.ocean12scripts.com Risk: High An sql injection allows anyone to login as admin using this sql query in the login panel: Adminid: Admin' UNI...

[HSC Security Group] Ocean12 Calendar manager 1.01 SQL injection

Hackers Center Security Group http://www.hackerscenter.com/ Zinho's Security Advisory Product: Ocean12 Calendar manager 1.01 Site: www.ocean12scripts.com The admin login panel suffers of an sql injection that allows anyone to log in as Admin. Proof of concept: /// - Adminid: Admin' UNION ALL SELE...

acnews.txt

http://www.google.com/search?hl=en&lr=&q=acnews+1.0+login.asp&btnG=Search /str0ke Product:ACNews version :1.0 VULNERABILITY CLASS: SQL injection exploit Log in with username:' or 'x'='x password :' or 'x'='x from admin/login.asp page. greetz to HaXoR & LOverboy auther : LaMeR securitygurus team...

CVE-2005-1149

SQL injection vulnerability in admin/login.asp in aspclick.it ACNews 1.0 allows remote attackers to execute arbitrary SQL commands via the 1 username or 2 password parameters...

phpMyFamily 1.4.0 - SQL Injection

phpMyFamily 1.4.0 - SQL Injection !/usr/bin/perl -w phpMyFamily Exploit injection ============================== $banner = "phpMyFamily Exploit injection \n\n============================== \n\nINFGPG-Hacking&Security Research"; Greats: AresU 1st IndoSec Team,ADZ Security Team has discovered bugs...

phpMyFamily 1.4.0 - Authentication Bypass

phpMyFamily 1.4.0 - Authentication Bypass Tested with version 1.2.5 /str0ke Login as admin without pass: Login: "' OR 'a'='a' AND admin='Y'/" without quotes Password: empty milw0rm.com 2005-03-21...

phpMyFamily 1.4.0 - Authentication Bypass

Tested with version 1.2.5 /str0ke Login as admin without pass: Login: "' OR 'a'='a' AND admin='Y'/" without quotes Password: empty milw0rm.com 2005-03-21...

SQL-инъекция в phpAdsNew

--------------------------------------------------------- SQL-инъекция в phpAdsNew --------------------------------------------------------- Автор: Григоров Роман Дата: Январь 13, 2005 e-mail: roman at mosk dot ru Icq: 157535663 --------------------------------------------------------- Уязвимый...