CVE-2011-3700: Exposure of Sensitive Information to an Unauthorized Actor

Advanced Electron Forum AEF 1.0.8 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by languages/english/deletetopiclang.php...

AEF Version 1.0.8 CMS Cross Site Scripting Vulnerability

Exploit for unknown platform in category web applications ======================================================== AEF Version 1.0.8 CMS Cross Site Scripting Vulnerability ======================================================== Topic : AEF Version 1.0.8 Bug Type : Cross Site Scripting Credit :...

AEF 1.0.8 Cross Site Scripting

Dear Sir / Madam The Itsecteam has discovered a new bug in AEF Version 1.0.8 CMS and will be glad to report and public it . more information about this bug is listed below : Topic : AEF Version 1.0.8 Bug Type : Cross Site Scripting Credit : ItSecTeam Remote : Yes Status : Bug Download Link...

CVE-2009-2546

Directory traversal vulnerability in Advanced Electron Forum AEF 1.x allows remote attackers to determine the existence of arbitrary files via the avatargalfile parameter when changing an avatar, which leaks the existence of the file in an error message. NOTE: the provenance of this information i...

Directory traversal

Directory traversal vulnerability in Advanced Electron Forum AEF 1.x allows remote attackers to determine the existence of arbitrary files via the avatargalfile parameter when changing an avatar, which leaks the existence of the file in an error message. NOTE: the provenance of this information i...

CVE-2009-2546

Directory traversal in Advanced Electron Forum (AEF) 1.x allows remote attackers to determine whether arbitrary files exist via the avatargalfile parameter when changing an avatar, causing information disclosure through error messages. No patch or remediation is stated in the provided documents.

CVE-2009-2545

CVE-2009-2545 describes an SQL injection in Advanced Electron Forum (AEF) 1.x when magic_quotes_gpc is disabled. The vulnerability allows remote attackers to inject arbitrary SQL through the filename field of an uploaded attachment. The available documents confirm the affected software and the un...

CVE-2009-2546: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Advanced Electron Forum AEF 1.x allows remote attackers to determine the existence of arbitrary files via the avatargalfile parameter when changing an avatar, which leaks the existence of the file in an error message. NOTE: the provenance of this information i...

CVE-2009-2545: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Advanced Electron Forum AEF 1.x, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the filename in an uploaded attachment. NOTE: the provenance of this information is unknown; the details are obtained solely from third...

Advanced Electron Forum <= 1.0.6 Remote Code Execution Vulnerability

No description provided by source. GulfTech Security Research September 20, 2008 Vendor : Electron Inc. URL : http://www.anelectron.com/ Version : AEF Forum = 1.0.6 Risk : Remote Code Execution Description: Advanced Electron Forum also known as AEF Forum is a full featured online forum system...

Advanced Electron Forum <= 1.0.6 Remote Code Execution Vulnerability

Exploit for unknown platform in category web applications ==================================================================== Advanced Electron Forum = 1.0.6 Remote Code Execution Vulnerability ==================================================================== GulfTech Security Research...

Advanced Electron Forum 1.0.6 - Remote Code Execution

Advanced Electron Forum 1.0.6 - Remote Code Execution GulfTech Security Research September 20, 2008 Vendor : Electron Inc. URL : http://www.anelectron.com/ Version : AEF Forum = 1.0.6 Risk : Remote Code Execution Description: Advanced Electron Forum also known as AEF Forum is a full featured onli...

advancedelectron-exec.txt

GulfTech Security Research September 20, 2008 Vendor : Electron Inc. URL : http://www.anelectron.com/ Version : AEF Forum = 1.0.6 Risk : Remote Code Execution Description: Advanced Electron Forum also known as AEF Forum is a full featured online forum system written in php that allows webmasters...

CVE-2008-1983

CVE-2008-1983 : In Advanced Electron Forum (AEF) 1.0.6, a Cross-site Scripting (XSS) vulnerability exists that allows remote attackers to inject arbitrary web script or HTML via the beg parameter in a members action to index.php. The provided sources state the issue but do not include exploitatio...

CVE-2008-1983: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Advanced Electron Forum AEF 1.0.6 allows remote attackers to inject arbitrary web script or HTML via the beg parameter in a members action to index.php...

Advanced Electron Forum 1.0.6 - 'beg' Cross-Site Scripting

source: https://www.securityfocus.com/bid/28865/info Advanced Electron Forum AEF is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user ...

Advanced Electron Forum 1.0.6 - beg Cross-Site Scripting

Advanced Electron Forum 1.0.6 - beg Cross-Site Scripting source: https://www.securityfocus.com/bid/28865/info Advanced Electron Forum AEF is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute...