CVE-2008-6360

Cross-site scripting XSS vulnerability in the userranks feature in modules/system/admin.php in ImpressCMS 1.0.2 final allows remote attackers to inject arbitrary web script or HTML via the ranktitle parameter. NOTE: some of these details are obtained from third party information...

CVE-2008-6360: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the userranks feature in modules/system/admin.php in ImpressCMS 1.0.2 final allows remote attackers to inject arbitrary web script or HTML via the ranktitle parameter. NOTE: some of these details are obtained from third party information...

CVE-2008-6302

TurnkeyForms Local Classifieds allows remote attackers to bypass authentication and gain administrative access via a direct request to SiteAdmin/admin.php...

CVE-2008-6296: Undefined Security Weakness

admin.php in Maran PHP Shop allows remote attackers to bypass authentication and gain administrative access by setting the user cookie to "demo."...

CVE-2008-6302: Undefined Security Weakness

TurnkeyForms Local Classifieds allows remote attackers to bypass authentication and gain administrative access via a direct request to SiteAdmin/admin.php...

Sql injection

SQL injection vulnerability in admin/admin.php in E-topbiz Slide Popups 1.0 allows remote attackers to execute arbitrary SQL commands via the password parameter...

Directory traversal

Directory traversal vulnerability in admin.php in Potato News 1.0.0 allows remote attackers to include and execute arbitrary files via a .. dot dot in the user cookie parameter...

CVE-2009-0722

Directory traversal vulnerability in admin.php in Potato News 1.0.0 allows remote attackers to include and execute arbitrary files via a .. dot dot in the user cookie parameter...

CVE-2008-6264

SQL injection vulnerability in admin/admin.php in E-topbiz Slide Popups 1.0 allows remote attackers to execute arbitrary SQL commands via the password parameter...

CVE-2008-6264

CVE-2008-6264 : Affected product is E-topbiz Slide Popups 1.0; vulnerability in the admin.php script (password parameter) enables SQL injection, allowing remote attackers to execute arbitrary SQL commands. Root cause appears to be insufficient input validation/sanitization in the affected code pa...

CVE-2009-0722: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in admin.php in Potato News 1.0.0 allows remote attackers to include and execute arbitrary files via a .. dot dot in the user cookie parameter...

CVE-2008-6264: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/admin.php in E-topbiz Slide Popups 1.0 allows remote attackers to execute arbitrary SQL commands via the password parameter...

zFeeder 1.6 (admin.php) No Authentication Vulnerability

No description provided by source. -----------------:remote bypass admin panel:----------------- ------------------------------------------------------- script:zfeeder 1.6 ------------------------------------------------------------------ download...

zFeeder 1.6 - admin.php Admin Bypass

zFeeder 1.6 - admin.php Admin Bypass -----------------:remote bypass admin panel:----------------- ------------------------------------------------------- script:zfeeder 1.6 ------------------------------------------------------------------ download...

zFeeder 1.6 - 'admin.php' Admin Bypass

-----------------:remote bypass admin panel:----------------- ------------------------------------------------------- script:zfeeder 1.6 ------------------------------------------------------------------ download...

CVE-2009-0673

Eval injection vulnerability in the Custom Fields feature in the Your Account module in Raven Web Services RavenNuke 2.30 allows remote authenticated administrators to execute arbitrary PHP code via the ID Field Name box in a yaCustomFields action to admin.php...

CVE-2009-0673

Eval injection vulnerability in the Custom Fields feature in the Your Account module in Raven Web Services RavenNuke 2.30 allows remote authenticated administrators to execute arbitrary PHP code via the ID Field Name box in a yaCustomFields action to admin.php...

CVE-2009-0673: Improper Control of Generation of Code

Eval injection vulnerability in the Custom Fields feature in the Your Account module in Raven Web Services RavenNuke 2.30 allows remote authenticated administrators to execute arbitrary PHP code via the ID Field Name box in a yaCustomFields action to admin.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in PhpForums.net mcGallery 1.1 allow remote attackers to inject arbitrary web script or HTML via the lang parameter to 1 admin.php, 2 index.php, 3 sess.php, 4 stats.php, 5 detail.php, 6 resize.php, and 7 show.php. NOTE: the provenance of this...

CVE-2008-6212

Php-Stats 0.1.9.1 is affected by a cross-site scripting (XSS) vulnerability in admin.php, exploitable via the sel_mese and sel_anno parameters in a systems action. The issue could allow a remote attacker to inject arbitrary web script or HTML when the affected page is loaded. No remediation detai...