236 matches found
vwar-sql.txt
Vendor : Www.Vwar.De Credits : Pouyaserver Ver : v1.5.0 [email protected] ----------------------------------------- http://host/vwar/calendar.php?month=SQL...
webSPELL 4.01.02 (calendar.php, usergallery.php) XSS Vulnerability
Autor: Brainhead Type: XSS Version: 4.01.02 Files: usergallery.php, calendar.php Magic Quotes :off Examples: http://site.tld/PATH/index.php?site=usergallery&action=upload&galleryID="your code http://site.tld/PATH/index.php?site=calendar&action=announce&upID="your code...
CVE-2003-1536
Multiple cross-site scripting XSS vulnerabilities in Codeworx Technologies DCP-Portal 5.3.1 allow remote attackers to inject arbitrary web script or HTML via 1 the q parameter to search.php and 2 the year parameter to calendar.php...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in vBulletin 3.6.8 allow remote attackers to inject arbitrary web code or HTML via the 1 s parameter to index.php, and the 2 q parameter to a faq.php, b member.php, c memberlist.php, d calendar.php, e search.php, f forumdisplay.php, g...
CVE-2007-4453
Multiple cross-site scripting XSS vulnerabilities in vBulletin 3.6.8 allow remote attackers to inject arbitrary web code or HTML via the 1 s parameter to index.php, and the 2 q parameter to a faq.php, b member.php, c memberlist.php, d calendar.php, e search.php, f forumdisplay.php, g...
CVE-2007-3258: Undefined Security Weakness
calendar.php in Calendarix 0.7.20070307 allows remote attackers to obtain sensitive information via large values to the 1 year and 2 month parameters, which causes negative values to be passed to the mktime library call, and reveals the installation path in the error message...
CVE-2007-3183
Multiple SQL injection vulnerabilities in Calendarix 0.7.20070307, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 month and 2 year parameters to calendar.php and the 3 search string to calsearch.php...
CVE-2007-3259: Undefined Security Weakness
Calendarix 0.7.20070307 allows remote attackers to obtain sensitive information via 1 an invalid month parameter to calendar.php, 2 an invalid catview parameter to calweek.php in a week operation, 3 an invalid ycyear parameter to yearcal.php, or 4 a direct request to calfunctions.inc.php, which...
CVE-2007-3183: Undefined Security Weakness
Multiple SQL injection vulnerabilities in Calendarix 0.7.20070307, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 month and 2 year parameters to calendar.php and the 3 search string to calsearch.php...
CVE-2007-3058: Undefined Security Weakness
Multiple PHP remote file inclusion vulnerabilities in Madirish Webmail 2.0 allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALSbasedir parameter to 1 calendar.php, 2 compose.php, and 3 index.php, different vectors than CVE-2007-2826. NOTE: the provenance of this informati...
Cross site scripting
Cross-site scripting XSS vulnerability in calendar.php in Jelsoft vBulletin 3.6.x before 3.6.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to the vbcalendar366xssfixplugin.xml update...
Cross site scripting
Cross-site scripting XSS vulnerability in calendar.php in Jelsoft vBulletin before 3.6.6 allows remote attackers to inject arbitrary web script or HTML via the title field in a single add action...
CVE-2007-2908
Cross-site scripting XSS vulnerability in calendar.php in Jelsoft vBulletin before 3.6.6 allows remote attackers to inject arbitrary web script or HTML via the title field in a single add action...
CVE-2007-2908
The CVE-2007-2908 entry describes a cross-site scripting (XSS) vulnerability in Jelsoft vBulletin’s calendar.php, exploitable to inject arbitrary HTML/Script via the title field during a single add action. Affected software is vBulletin prior to version 3.6.6. The underlying issue is an input han...
CVE-2007-2909
CVE-2007-2909 is an XSS vulnerability in Jelsoft vBulletin 3.6.x (before 3.6.7) affecting calendar.php, with the issue tied to the vb_calendar366_xss_fix_plugin.xml update. Affected software is Jelsoft vBulletin 3.6.x; the vulnerability allows remote injection of script/HTML via unspecified vecto...
CVE-2007-2909: Undefined Security Weakness
Cross-site scripting XSS vulnerability in calendar.php in Jelsoft vBulletin 3.6.x before 3.6.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to the vbcalendar366xssfixplugin.xml update...
CVE-2007-2908: Undefined Security Weakness
Cross-site scripting XSS vulnerability in calendar.php in Jelsoft vBulletin before 3.6.6 allows remote attackers to inject arbitrary web script or HTML via the title field in a single add action...
vbulletin < 3.6.6 [permanent xss]
vendor site:http://www.vbulletin.com/ product:vbulletin 3.6.6 bug: permanent xss affected file: calendar.php risk : medium xss permanent must be loggued PoC : http://127.0.0.1/vbulletin/calendar.php?do=add&type=single&c=1 -- fill up the title field with : /titlescriptalertdocument.cookie/script...
vbul366-xss.txt
vendor site:http://www.vbulletin.com/ product:vbulletin fill up the title field with : alertdocument.cookie Event Date : some far away date ... like 2010 for exemple message : whatever . when it's done look at the :"Request Reminder for this Event" link. it looks like this:...
