CVE-2007-0815

Cross-site scripting XSS vulnerability in imagesarchive.asp in Uapplication Uphotogallery 1.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the s parameter. NOTE: the thumbnails.asp vector is already covered by CVE-2006-3023...

CVE-2007-0815

CVE-2007-0815 is an XSS vulnerability in Uapplication Uphotogallery 1.1: the images_archive.asp endpoint is vulnerable to script/HTML injection via the s parameter. The vulnerability requires authenticated remote administrators. The thumbnails.asp vector is already covered by CVE-2006-3023.

CVE-2007-0596

PHP remote file inclusion vulnerability in index/main.php in Aztek Forum 4.00 allows remote authenticated administrators to execute arbitrary PHP code via a URL in the PFtopurl parameter...

CVE-2007-0115

Static code injection vulnerability in Coppermine Photo Gallery 1.4.10 and earlier allows remote authenticated administrators to execute arbitrary PHP code via the Username to login.php, which is injected into an error message in security.log.php, which can then be accessed using viewlog.php...

Sql injection

Multiple SQL injection vulnerabilities in Coppermine Photo Gallery 1.4.10 and earlier allow remote authenticated administrators to execute arbitrary SQL commands via 1 the cat parameter to albmgr.php, and possibly 2 the gid parameter to usermgr.php; 3 the start parameter to dbecard.php; and the...

CVE-2007-0122

Multiple SQL injection vulnerabilities in Coppermine Photo Gallery 1.4.10 and earlier allow remote authenticated administrators to execute arbitrary SQL commands via 1 the cat parameter to albmgr.php, and possibly 2 the gid parameter to usermgr.php; 3 the start parameter to dbecard.php; and the...

CVE-2007-0122

Coppermine Photo Gallery 1.4.10 and earlier has multiple SQL injection vulnerabilities that allow remote authenticated administrators to execute arbitrary SQL commands. Affected parameters include (1) cat in albmgr.php, (2) gid in usermgr.php, (3) start in db_ecard.php, and (4) albumid in unspeci...

CVE-2006-6815

Multiple cross-site scripting XSS vulnerabilities in DMXReady Secure Login Manager 1.0 allow remote authenticated administrators to inject arbitrary web script or HTML via unspecified parameters to 1 setpreferences.asp, 2 sendpasswordpreferences.asp, and 3 SecureLoginManager/list.asp in the...

CVE-2006-6347

Unrestricted file upload vulnerability in TFT-Gallery allows remote authenticated administrators to upload arbitrary .php files, possibly using admin/index.php. NOTE: this can be leveraged with CVE-2006-1412 to create a remote unauthenticated vector...

CVE-2006-6347

Unrestricted file upload vulnerability in TFT-Gallery allows remote authenticated administrators to upload arbitrary .php files, possibly using admin/index.php. NOTE: this can be leveraged with CVE-2006-1412 to create a remote unauthenticated vector...

CVE-2006-6284

Directory traversal vulnerability in admin.php in Vikingboard 0.1.2 allows remote authenticated administrators to include arbitrary files via a .. dot dot sequence in the act parameter...

CVE-2006-5738

Multiple SQL injection vulnerabilities in PunBB before 1.2.14 allow remote authenticated administrators to execute arbitrary SQL commands via unspecified vectors...

CVE-2006-3826

Multiple cross-site scripting XSS vulnerabilities in Kailash Nadh boastMachine formerly bMachine 3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 userlogin, 2 fullname, and 3 URL parameters in register.php; and allow remote authenticated administrators to...

CVE-2006-3827

SQL injection vulnerability in bmc/Inc/core/admin/search.inc.php in Kailash Nadh boastMachine formerly bMachine 3.1 and earlier allows remote authenticated administrators to execute arbitrary SQL commands via the blog parameter...

CVE-2006-3830

The CVE-2006-3830 issue affects Kailash Nadh’s boastMachine (formerly bMachine) up to version 3.1. Remote authenticated administrators can upload files with arbitrary extensions to the bmc/Inc/Lang directory. The uploaded files are not served over HTTP, so exploitation hinges on a local usage pat...

CVE-2006-3826

CVE-2006-3826: XSS in Kailash Nadh boastMachine (3.1 and earlier) allows remote injection via register.php parameters (user_login, full_name, URL) and via admin interface parameters (cat_list, key); no exploitation status or patch details are provided in the connected documents.

CVE-2006-3828

The CVE-2006-3828 entry concerns Kailash Nadh’s boastMachine (formerly bMachine)

CVE-2006-2467

BEA WebLogic Server 8.1 up to SP4, 7.0 up to SP6, and 6.1 up to SP7 displays the internal IP address of the WebLogic server in the WebLogic Server Administration Console, which allows remote authenticated administrators to determine the address...

CVE-2005-4800

Direct static code injection vulnerability in Yet Another PHP Image Gallery YaPIG 0.95b and earlier allows remote authenticated administrators to inject arbitrary PHP code via the TestGallery parameter in a modinfo action to modifygallery.php, which inserts the code into guidinfo.php. NOTE: this...

CVE-2006-2335

Jelsoft vBulletin accepts uploads of Cascading Style Sheets CSS and processes them in a way that allows remote authenticated administrators to gain shell access by uploading a CSS file that contains PHP code, then selecting the file via the style chooser, which causes the PHP code to be executed...