CuteNews flood.db.php Client-IP HTTP Header Arbitrary Code Injection

The version of CuteNews installed on the remote host fails to properly sanitize the IP addresses of clients using the system before logging them to a known file. An attacker can exploit this flaw to inject arbitrary PHP code through a Client-IP request header and then execute that code by...

CVE-2005-2043

CVE-2005-2043 affects XAMPP prior to 1.4.14, where a directory traversal via lang.php allows remote attackers to inject arbitrary HTML and PHP code. This is a server-side input handling flaw in the XAMPP package, enabling code injection through the vulnerable script. The available documents do no...

Fusion SBX <= 1.2 Remote Command Execution Exploit

Exploit for unknown platform in category web applications ================================================== Fusion SBX = 1.2 Remote Command Execution Exploit ================================================== / Fusion SBX = 1.2 exploit sileFSBXxpl This exploit use vulnerability found into Fusion...

Fusion News comments.php X-Forwarded-For HTTP Header Arbitrary Code Injection

The version of Fusion News installed on the remote host suffers from a flaw that allows a remote attacker to execute arbitrary PHP code subject to the privileges of the web server userid. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; i...

CVE-2004-1926: Improper Control of Generation of Code

Tiki CMS/Groupware TikiWiki 1.8.1 and earlier allows remote attackers to inject arbitrary code via the 1 Theme, 2 Country, 3 Real Name, or 4 Displayed time zone fields in a User Profile, or the 5 Name, 6 Description, 7 URL, or 8 Country fields in a Directory/Add Site operation...

paNews admin_setup.php Multiple Parameter Arbitrary PHP Code Injection

The remote host is running a version of paNews that fails to properly sanitize input passed to the script 'includes/adminsetup.php' and, in addition, allows writes by the web user to the directory 'includes' not the default configuration. Taken together, these flaws allow a remote attacker to run...

SIR GNUBoard Remote File Inclusion

It is possible to make the remote web server read arbitrary files by using the GNUBoard CGI suite which is installed. An attacker may use this flaw to inject arbitrary code in the remote host and gain a shell with the privileges of the web server. %NASLMINLEVEL 70300 C Tenable Network Security,...

mpg123 -- playlist processing buffer overflow vulnerability

A buffer overflow vulnerability exists in the playlist processing of mpg123. A specially crafted playlist entry can cause a stack overflow that can be used to inject arbitrary code into the mpg123 process. Note that a malicious playlist, demonstrating this vulnerability, was released by the bug...

Debian DSA-125-1 : analog - XSS

Yuji Takahashi discovered a bug in analog which allows a cross-site scripting type attack. It is easy for an attacker to insert arbitrary strings into any web server logfile. If these strings are then analysed by analog, they can appear in the report. By this means an attacker can introduce...

EasyDynamicPages Multiple Script edp_relative_path Parameter Remote File Inclusion

The remote host is running EasyDynamicPages, a set of PHP scripts designed to help web publication. It is possible with this suite to make the remote host include PHP files hosted on a third-party server. An attacker may use this flaw to inject arbitrary code in the remote host and gain a shell...

E-theni aff_liste_langue.php rep_include Parameter Remote File Inclusion

It is possible to make the remote host include PHP files hosted on a third-party server using E-Theni. An attacker may use this flaw to inject arbitrary code in the remote host and gain a shell with the privileges of the web server. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Ref: From:...