171 matches found
CVE-2007-4453
Multiple cross-site scripting XSS vulnerabilities in vBulletin 3.6.8 allow remote attackers to inject arbitrary web code or HTML via the 1 s parameter to index.php, and the 2 q parameter to a faq.php, b member.php, c memberlist.php, d calendar.php, e search.php, f forumdisplay.php, g...
CVE-2007-3183
Multiple SQL injection vulnerabilities in Calendarix 0.7.20070307, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 month and 2 year parameters to calendar.php and the 3 search string to calsearch.php...
Cross site scripting
Cross-site scripting XSS vulnerability in calendar.php in Jelsoft vBulletin 3.6.x before 3.6.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to the vbcalendar366xssfixplugin.xml update...
Cross site scripting
Cross-site scripting XSS vulnerability in calendar.php in Jelsoft vBulletin before 3.6.6 allows remote attackers to inject arbitrary web script or HTML via the title field in a single add action...
CVE-2007-2908
Cross-site scripting XSS vulnerability in calendar.php in Jelsoft vBulletin before 3.6.6 allows remote attackers to inject arbitrary web script or HTML via the title field in a single add action...
CVE-2007-2909
CVE-2007-2909 is an XSS vulnerability in Jelsoft vBulletin 3.6.x (before 3.6.7) affecting calendar.php, with the issue tied to the vb_calendar366_xss_fix_plugin.xml update. Affected software is Jelsoft vBulletin 3.6.x; the vulnerability allows remote injection of script/HTML via unspecified vecto...
CVE-2007-2908
The CVE-2007-2908 entry describes a cross-site scripting (XSS) vulnerability in Jelsoft vBulletin’s calendar.php, exploitable to inject arbitrary HTML/Script via the title field during a single add action. Affected software is vBulletin prior to version 3.6.6. The underlying issue is an input han...
vbulletin < 3.6.6 [permanent xss]
vendor site:http://www.vbulletin.com/ product:vbulletin 3.6.6 bug: permanent xss affected file: calendar.php risk : medium xss permanent must be loggued PoC : http://127.0.0.1/vbulletin/calendar.php?do=add&type=single&c=1 -- fill up the title field with : /titlescriptalertdocument.cookie/script...
vbul366-xss.txt
vendor site:http://www.vbulletin.com/ product:vbulletin fill up the title field with : alertdocument.cookie Event Date : some far away date ... like 2010 for exemple message : whatever . when it's done look at the :"Request Reminder for this Event" link. it looks like this:...
vBulletin < 3.6.7 calendar.php title Parameter Persistent HTML Injection
Binary data 3994.prm...
Sql injection
SQL injection vulnerability in calendar.php in MyBB aka MyBulletinBoard 1.2.5 and earlier allows remote attackers to execute arbitrary SQL commands via the day parameter in a dayview action...
Sql injection
Multiple SQL injection vulnerabilities in calendar.php in MyBB aka MyBulletinBoard 1.2.5 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 year or 2 month parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...
CVE-2007-2212
CVE-2007-2212 affects MyBB (MyBulletinBoard)
MyBB calendar.php脚本远程SQL注入漏洞
MyBB是一款流行的Web论坛程序。 MyBB的实现上存在输入验证漏洞，远程攻击者可能利用此漏洞非授权访问操作数据库。 MyBB的calendar.php脚本没有对year、month或day参数数据做充分的检查过滤，远程攻击者可以在输入数据中插入特定的SQL语句，导致攻击者浏览、添加或修改删除后端数据库中的信息。 MyBB MyBB = 1.2.5 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.mybboard.com/ http://www.sebug.net/show-exp-1760.html...
MyBulletinBoard (MyBB) <= 1.2.5 calendar.php Blind SQL Injection Exploit
No description provided by source. !/usr/bin/perl use LWP::UserAgent; use Getopt::Long; if!$ARGV1 print " \n"; print " \n"; print " MyBulletinBoard = 1.2.5 Remote SQL Injection Exploit \n"; print " Bug found and Exploit coded by 0x86 \n"; print " \n"; print " www.geeksec.net \n"; print " 0x86 at...
MyBulletinBoard (MyBB) 1.2.5 - calendar.php Blind SQL Injection
MyBulletinBoard MyBB 1.2.5 - calendar.php Blind SQL Injection !/usr/bin/perl use LWP::UserAgent; use Getopt::Long; if!$ARGV1 print " \n"; print " \n"; print " MyBulletinBoard \n"; print " Example: perl mybb.pl www.host.com /mybb/ -u 5 \n"; print " \n"; print " Options: \n"; print " -u User-ID,...
MyBulletinBoard (MyBB) 1.2.5 - 'calendar.php' Blind SQL Injection
!/usr/bin/perl use LWP::UserAgent; use Getopt::Long; if!$ARGV1 print " \n"; print " \n"; print " MyBulletinBoard \n"; print " Example: perl mybb.pl www.host.com /mybb/ -u 5 \n"; print " \n"; print " Options: \n"; print " -u User-ID, default: 1 \n"; print " -p Proxy support \n"; print " \n"; exit;...
CVE-2007-1236
sitex allows remote attackers to obtain sensitive information via a request with a numerical value for the 1 sxMonth or 2 sxYear parameter to calendar.php, or the 3 page parameter to calendarevents.php, which reveals the path in various error messages...
CVE-2007-1236
CVE-2007-1236 affects sitex applications and concerns information disclosure through error messages produced by calendar.php (parameters sxMonth[] or sxYear[]) and calendar_events.php (parameter page[]). An attacker can craft requests with numerical values that cause error responses revealing the...