3560 matches found
CVE-2005-2012
paFAQ 1.0 Beta 4 is affected by multiple SQL injection vulnerabilities in the login flow, allowing remote attackers to bypass authentication by manipulating the (1) username or (2) id parameters. The Nessus plugin and CVE records corroborate that the remote PHP/MySQL application is vulnerable to ...
CVE-2005-2013
The CVE-2005-2013 entry concerns paFAQ 1.0 Beta 4, a PHP/MySQL web application. The described vulnerability allows remote attackers to access admin/backup.php directly, which contains a backup of the database including usernames and passwords. This exposure could reveal administrator credentials ...
CVE-2005-2014
The "upload a language pack" feature in paFAQ 1.0 Beta 4 allows remote authenticated administrators to execute arbitrary PHP commands by uploading a malicious language pack...
CVE-2005-2013
paFAQ 1.0 Beta 4 allows remote attackers to obtain sensitive information via a direct request to admin/backup.php, which contains a backup of the database including usernames and passwords...
CVE-2005-2012
Multiple SQL injection vulnerabilities in login in paFAQ 1.0 Beta 4 allow remote attackers to execute arbitrary SQL commands and bypass authentication via the 1 username or 2 id parameters...
CVE-2005-1782
BookReview beta 1.0 is affected by multiple cross-site scripting (XSS) vulnerabilities due to lack of input sanitization. Concrete vectors include injecting script via: node parameter on add_review.htm, suggest_review.htm, suggest_category.htm, add_booklist.htm, add_url.htm; isbn parameter on add...
CVE-2005-1782
Multiple cross-site scripting XSS vulnerabilities in BookReview beta 1.0 allow remote attackers to inject arbitrary web script or HTML via the node parameter to 1 addreview.htm, 2 suggestreview.htm, 3 suggestcategory.htm, 4 addbooklist.htm, or 5 addurl.htm, the isbn parameter to 6 addreview.htm, ...
CVE-2005-1783
BookReview beta 1.0 allows remote attackers to obtain the path of the web server via certain parameters to search.htm, possibly due to a searchstring parameter with a missing value or an incorrect submittype value, which reveals the path in the resulting error message. NOTE: it is not clear wheth...
CVE-2005-1782
Multiple cross-site scripting XSS vulnerabilities in BookReview beta 1.0 allow remote attackers to inject arbitrary web script or HTML via the node parameter to 1 addreview.htm, 2 suggestreview.htm, 3 suggestcategory.htm, 4 addbooklist.htm, or 5 addurl.htm, the isbn parameter to 6 addreview.htm, ...
CVE-2003-1197
Cross-site scripting XSS vulnerability in index.php for Ledscripts.com LedForums Beta 1 allows remote attackers to inject arbitrary web script or HTML via the 1 topmessage parameter or 2 topic field of a new thread...
CVE-2003-1195
SQL injection vulnerability in getmember.asp in VieBoard 2.6 Beta 1 allows remote attackers to execute arbitrary SQL commands via the msn variable...
CVE-2003-1195
Technical details (affected products/versions/root cause/exploits) are not publicly provided in the supplied documents. Monitor for updates from official advisories.
CVE-2003-1197
The CVE-2003-1197 entry documents a cross-site scripting (XSS) vulnerability in LedForums Beta 1 running on Ledscripts.com, exploitable via index.php in the parameters top_message or the topic field when creating a new thread. Affected software is LedForums Beta 1; the underlying issue is imprope...
CVE-2005-1169
Mafia Blog .4 BETA does not properly protect the admin directory, which allows remote attackers to execute arbitrary PHP code by using writeinfo.php to inject the code into info.php...
CVE-2005-1169: Undefined Security Weakness
Mafia Blog .4 BETA does not properly protect the admin directory, which allows remote attackers to execute arbitrary PHP code by using writeinfo.php to inject the code into info.php...
CVE-2005-1139: Undefined Security Weakness
Opera 8 Beta 3, when using first-generation vetted digital certificates, displays the Organizational information of an SSL certificate, which is easily spoofed and can facilitate phishing attacks...
CVE-2005-0855
CVE-2005-0855 affects CoolForum 0.8.1 beta and earlier. The issue allows remote attackers to trigger PHP error messages via direct requests to eight PHP pages (entete.php, profile_accueil.php, profile_mdp.php, profile_notify.php, profile_options.php, profile_perso.php, profile_pm.php, readannonce...
ZPanel <= 2.5 Remote SQL Injection Exploit
Exploit for unknown platform in category web applications ========================================== ZPanel = 2.5 Remote SQL Injection Exploit ========================================== Tested and working /str0ke It is possible to include arbitrary file: local - in version ZPanel = 2.5 beta 10,...
DEBIAN-CVE-2005-0535
Cross-site request forgery CSRF vulnerability in MediaWiki 1.3.x before 1.3.11 and 1.4 beta before 1.4 rc1 allows remote attackers to perform unauthorized actions as authenticated MediaWiki users...