448 matches found
CVE-2006-2618
Cross-site scripting XSS vulnerability in 1 AlstraSoft Web Host Directory 1.2, aka 2 HyperStop WebHost Directory 1.2, might allow remote attackers to inject arbitrary web script or HTML via the "write a review" box. NOTE: since user reviews do not require administrator privileges, and an...
CVE-2006-2618
The CVE-2006-2618 entry describes a cross-site scripting (XSS) vulnerability in AlstraSoft Web Host Directory 1.2 and HyperStop WebHost Directory 1.2, exploitable via the "+write a review" box. The flaw allows remote attackers to inject arbitrary web script or HTML, with the issue arising because...
CVE-2006-2617
Affected products: AlstraSoft Web Host Directory 1.2 (aka HyperStop WebHost Directory 1.2). Root cause: an invalid entry in the Username field on the login page can produce an SQL error that reveals the installation path, potentially due to SQL injection. Impact: partial disclosure of installatio...
AlstraSoft E-Friends - XSS
AlstraSoft E-Friends - XSS Homepage: http://www.alstrasoft.com/ Description: Alstrasoft E-friends allows you to run a community site like MySpace and Friendster. Effected files or areas of site: index.php The input forms on the following items belowdo not properlly filter out all potential harmfu...
Sql injection
SQL injection vulnerability in Alstrasoft Article Manager Pro 1.6 allows remote attackers to execute arbitrary SQL commands via 1 the authorid parameter in profile.php and 2 the autid parameter in userarticles.php. NOTE: the autid vector can produce resultant path disclosure if the SQL manipulati...
Design/Logic Flaw
Alstrasoft Article Manager Pro 1.6 allows remote attackers to obtain sensitive information via 1 a quote character or possibly an invalid value in the action parameter in a request to mrarticles.php or 2 a login QUERYSTRING to admin.php without any additional parameters, which reveal the path in...
Cross site scripting
Cross-site scripting XSS vulnerability in submitarticle.php in Alstrasoft Article Manager Pro 1.6 allows remote attackers to inject arbitrary web script or HTML when submitting an article, as demonstrated using a javascript URI in a Cascading Style Sheets CSS property of a STYLE attribute of an...
CVE-2006-2566
Alstrasoft Article Manager Pro 1.6 allows remote attackers to obtain sensitive information via 1 a quote character or possibly an invalid value in the action parameter in a request to mrarticles.php or 2 a login QUERYSTRING to admin.php without any additional parameters, which reveal the path in...
CVE-2006-2567
Cross-site scripting XSS vulnerability in submitarticle.php in Alstrasoft Article Manager Pro 1.6 allows remote attackers to inject arbitrary web script or HTML when submitting an article, as demonstrated using a javascript URI in a Cascading Style Sheets CSS property of a STYLE attribute of an...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in index.php in AlstraSoft E-Friends allow remote attackers to inject arbitrary web script or HTML by 1 posting a blog, 2 posting a listing, 3 posting an event, 4 adding comments, or 5 sending a message...
CVE-2006-2565
SQL injection vulnerability in Alstrasoft Article Manager Pro 1.6 allows remote attackers to execute arbitrary SQL commands via 1 the authorid parameter in profile.php and 2 the autid parameter in userarticles.php. NOTE: the autid vector can produce resultant path disclosure if the SQL manipulati...
CVE-2006-2565
Affected software: Alstrasoft Article Manager Pro 1.6. The vulnerability is an SQL injection in two parameters: author_id in profile.php and aut_id in userarticles.php. The SQL manipulation may lead to arbitrary SQL execution and, for the aut_id vector, potential resultant path disclosure if the ...
CVE-2006-2567
CVE-2006-2567 is an XSS vulnerability in the Alstrasoft Article Manager Pro 1.6, affecting the submit_article.php handler. The issue arises from unsafely handling user input in a STYLE attribute, enabling an attacker to inject JavaScript via a javascript: URI in a CSS property, potentially compro...
CVE-2006-2566
Alstrasoft Article Manager Pro 1.6 allows remote attackers to obtain sensitive information via 1 a quote character or possibly an invalid value in the action parameter in a request to mrarticles.php or 2 a login QUERYSTRING to admin.php without any additional parameters, which reveal the path in...
CVE-2006-2566
Affected software: Alstrasoft Article Manager Pro 1.6. The vulnerability is an information disclosure that exposes the path via error messages in two potential inputs: (1) the action parameter in a request to mrarticles.php (possible quote character or invalid value) and (2) a login QUERY_STRING ...
CVE-2006-2564
CVE-2006-2564 concerns multiple XSS vulnerabilities in the index.php of AlstraSoft E-Friends. The vulnerability enables remote attackers to inject arbitrary web script or HTML by performing actions such as posting a blog, listing, event, adding comments, or sending a message. Connected records co...
CVE-2006-2565
SQL injection vulnerability in Alstrasoft Article Manager Pro 1.6 allows remote attackers to execute arbitrary SQL commands via 1 the authorid parameter in profile.php and 2 the autid parameter in userarticles.php. NOTE: the autid vector can produce resultant path disclosure if the SQL manipulati...
sPaiz-Nuke Cross-Site Scripting Vulnerability
NightWarriorKurdish Hacker nightwarrior771athotmail.com sPaiz-Nuke Cross-Site Scripting Vulnerability http://www.alstrasoft.com http://www.example.com/sPaiz-Nuke/modules.php?name=Articles&file=search&query=XSS&type=articles&type=comments...
alstrasoftXSS.txt
NightWarrior nightwarrior771athotmail.com AlstraSoft Template Seller Pro Cross-Site Scripting Vulnerability http://www.alstrasoft.com http://vicktimhost/template/fullview.php?tempid=XSS Contact :nightwarrior771athotmail.com NightWarrior...