Geotarget - 'script.php' Remote File Inclusion

source: https://www.securityfocus.com/bid/20272/info Geotarget is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also...

Multiple XSS Vulnerabilities in Zen Cart 1.3.5

Armorize Technologies Security Advisory Advisory No: Armorize-ADV-2006-0003 Date: 2006/9/27 Summary: Armorize-ADV-2006-0003 discloses multiple cross-site scripting vulnerabilities that are found in Zen Cart, which is a PHP e-commerce shopping program and is Built on a foundation of OScommerce GPL...

OpenSSL SSL_get_shared_ciphers() vulnerable to buffer overflow

Overview A buffer overflow vulnerability in an OpenSSL library function could allow a remote attacker to execute code on an affected system. Description The OpenSSL toolkit implements the Secure Sockets Layer SSL versions 2 and 3 and Transport Layer Security TLS version 1 protocols as well as a...

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

CubeCart 3.0.x - 'footer.inc.php?la_pow_by' Cross-Site Scripting

source: https://www.securityfocus.com/bid/20215/info CubeCart is prone to multiple input-validation vulnerabilities, including information-disclosure, cross-site scripting, and SQL-injection issues, because the application fails to properly sanitize user-supplied input. A successful exploit of...

CVE-2006-4918

In Simple Discussion Board 0.1.0, the vulnerability is a PHP remote file inclusion issue that can allow an attacker to execute arbitrary PHP code. The flaw arises when user-supplied URLs and paths are used by env_dir (for blank.php, admin.php, builddb.php) and script_root parameters, enabling rem...

ECardPro 2.0 - search.asp SQL Injection

ECardPro 2.0 - search.asp SQL Injection source: https://www.securityfocus.com/bid/20080/info ECardPro is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to...

Telekorn Signkorn Guestbook 1.x - '/help/en/adminhelp0.php?dir_path' Remote File Inclusion

source: https://www.securityfocus.com/bid/19977/info Telekorn Signkorn Guestbook is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. This may allow the attacker to compromise the application and the underlying system; other attack...

PHProg 1.0 - Multiple Input Validation Vulnerabilities

source: https://www.securityfocus.com/bid/19942/info PHProg is prone to multiple input-validation vulnerabilities because the application fails to sanitize user-supplied input. These issues include a cross-site scripting vulnerability and a local file-include vulnerability. A successful exploit m...

YACS 6.6.1 - Multiple Remote File Inclusions

source: https://www.securityfocus.com/bid/19799/info YACS is prone multiple remote file-include vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execut...

Anychart 3.0 - Password SQL Injection

Anychart 3.0 - Password SQL Injection source: https://www.securityfocus.com/bid/19330/info anychart is prone to an SQL-injection vulnerability because it fails to properly sanitize user-supplied input before using it in an SQL query. A successful attack could allow an attacker to compromise the...

Joomla! Component Liga Manager Online 2.0 - Remote File Inclusion

Joomla! Component Liga Manager Online 2.0 - Remote File Inclusion source: https://www.securityfocus.com/bid/19234/info Liga Manager Online Joomla! Component is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input...

Bosdates 3.x4.0 - Payment.php Remote File Inclusion

Bosdates 3.x4.0 - Payment.php Remote File Inclusion source: https://www.securityfocus.com/bid/19191/info Bosdates is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this issue to include an arbitrary remote file...

PHP Pro Bid 5.2.4 - 'auctionsearch.php?advsrc' Cross-Site Scripting

source: https://www.securityfocus.com/bid/19158/info PHP Pro Bid is prone to multiple input-validation vulnerabilities, including cross-site scripting and SQL-injection issues, because the application fails to properly sanitize user-supplied input. A successful exploit of these vulnerabilities...

LinksCaffe 3.0 - 'links.php?newdays' Cross-Site Scripting

source: https://www.securityfocus.com/bid/19149/info LinksCaffe is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. Successf...

IDevSpot PHPHostBot 1.0 - index.php Remote File Inclusion

IDevSpot PHPHostBot 1.0 - index.php Remote File Inclusion source: https://www.securityfocus.com/bid/19084/info PHPHostBot is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this issue to include an arbitrary remote fi...

FlatNuke 2.5.7 - index.php Remote File Inclusion

FlatNuke 2.5.7 - index.php Remote File Inclusion source: https://www.securityfocus.com/bid/18966/info FlatNuke is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit this issue to include...

Invision Power Board 2.1.x IPSClass.PHP SQL Injection Vulnerability 1

Invision Power Board 2.1.x IPSClass.PHP SQL Injection Vulnerability 1. Webapps exploit for php platform source: http://www.securityfocus.com/bid/18984/info Invision Power Board is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize...

PHP Event Calendar 1.4 - calendar.php Remote File Inclusion

PHP Event Calendar 1.4 - calendar.php Remote File Inclusion source: https://www.securityfocus.com/bid/18965/info PHP Event Calendar is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit...

Farsinews 3.0 - Tiny_mce_gzip.php Directory Traversal

Farsinews 3.0 - Tinymcegzip.php Directory Traversal source: https://www.securityfocus.com/bid/18925/info Farsinews is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability to retrieve arbitrary files from...