CVE-2006-7062

calendar.php in Kamgaing Email System kmail 2.3 and earlier allows remote attackers to obtain the full path of the server via an invalid d parameter, which leaks the path in an error message...

CVE-2006-7062

CVE-2006-7062 affects Kamgaing Email System (kmail) version ≤ 2.3. The vulnerability in calendar.php arises from handling an invalid d parameter, causing an error message that leaks the server’s full filesystem path. This is an information disclosure (remote, network-based) with a CVSS v2 base sc...

ltwCalendar => 4.2.1 Remote File Include Vulnerabilities

""""""""""""""""""""""""""""""""""""""""""""""" """ :: :: ::::: :::: """ """ :: :: :: : :: """ """ :::: :: :: ::::: ::::: :::: """ """ :: :: ::: ::: :: :: :: :: :: """ """ :: :: :: : : ::::: :: :: :::: """ """ """ """"""""""""""""""""""""""""""""""""""""""""""" Xmor$ DigitaL Hacking TeaM...

YaBBSM 3.0.0 (Offline.php) Remote File Include Vulnerability

No description provided by source. DESCRIPTION Remote file include vuln found by sZ oct 09, 2006 SOFTWARE Supermod 3.0 for yabb VENDOR URL http://www.supermod.org DORK YaBBSM V2.5.0 // Powered by YaBBSM V2.5.0 Based on YABB SE NOTES greetz to: neo-vortex, sk0tie, icez, Solano College CIS students...

YaBBSM 3.0.0 - Offline.php Remote File Inclusion

YaBBSM 3.0.0 - Offline.php Remote File Inclusion DESCRIPTION Remote file include vuln found by sZ oct 09, 2006 SOFTWARE Supermod 3.0 for yabb VENDOR URL http://www.supermod.org DORK YaBBSM V2.5.0 // Powered by YaBBSM V2.5.0 Based on YABB SE NOTES greetz to: neo-vortex, sk0tie, icez, Solano Colleg...

YaBBSM 3.0.0 (Offline.php) Remote File Include Vulnerability

Exploit for unknown platform in category web applications ============================================================ YaBBSM 3.0.0 Offline.php Remote File Include Vulnerability ============================================================ DESCRIPTION Remote file include vuln found by sZ oct 09,...

vtiger CRM <= 4.2 (calpath) Multiple Remote File Include Vulnerabilities

No description provided by source. \ /\ \ / | \ \ | / \ // / | \ | \ \ Y / | \ / / \ /| /\ / / / / / .OR.ID ECHOADV54$2006 ----------------------------------------------------------------------------------------------- ECHOADV54$2006vtiger CRM =4.2 calpath Multiple Remote File Inclusion...

CVE-2006-4224

Cross-site scripting XSS vulnerability in calendar.php in Virtual War VWar 1.5.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the year parameter. NOTE: The page parameter vector is covered by CVE-2006-4009...

CVE-2006-4224

CVE-2006-4224 is an XSS vulnerability in Virtual War (VWar) calendar.php affecting VWar 1.5.0 and earlier. The vulnerability allows remote attackers to inject arbitrary web script or HTML via the year parameter. The CVE also notes that the page parameter vector is covered by CVE-2006-4009. No fur...

wwwthreadsXSS.txt

---------------------------------------------------------- Aria-Security.net Advisory Discovered by: l2odon Gr33t to: A.u.r.a & O.U.T.L.A.W & R@1D3N @ DrtRp & Cl0wn ----------------------------------------------------------- Software: wwwThreads Attack method: Cross Site Scripting Original...

CVE-2006-3909

CVE-2006-3909 is a Cross-site Scripting (XSS) vulnerability in calendar.php of WWWthreads, exploitable by remote attackers who can inject arbitrary web script or HTML through the week parameter. Affects the WWWthreads calendar.php component; root cause is improper handling of user-supplied week d...

CVE-2006-3909

Cross-site scripting XSS vulnerability in calendar.php in WWWthreads allows remote attackers to inject arbitrary web script or HTML via the week parameter...

wwwThreads - 'calendar.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/19177/info WWWThreads is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the conte...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Kamgaing Email System kmail 2.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 d parameter to main.php, ordner parameter to 2 main.php, or 3 webdisk.php, 4 draft parameter to compose.php, or 5 m, or 6 y...

Sql injection

SQL injection vulnerability in calendar.php in vBulletin 3.0.x allows remote attackers to execute arbitrary SQL commands via the eventid parameter. NOTE: the affected version has been disputed by the vendor. It appears that this is the same issue as CVE-2004-0036, which was fixed in 2.3.4...

CVE-2006-2018

CVE-2006-2018 is a SQL injection vulnerability in calendar.php of vBulletin 3.0.x where the eventid parameter enables remote attackers to execute arbitrary SQL. The entry notes that the affected version has been disputed by the vendor and associates this issue with CVE-2004-0036, which was fixed ...

CVE-2006-2018

SQL injection vulnerability in calendar.php in vBulletin 3.0.x allows remote attackers to execute arbitrary SQL commands via the eventid parameter. NOTE: the affected version has been disputed by the vendor. It appears that this is the same issue as CVE-2004-0036, which was fixed in 2.3.4...

Virtual War File İnclusion

Virtual War File nclusion --------------------------------- Site:http://www.vwar.de/ Demo:http://www.vwar.de/demo/ --------------------------------------- File nclusion // get functions $vwarroot = "./"; require $vwarroot . "includes/functionscommon.php"; require $vwarroot...

Cross site scripting

Cross-site scripting vulnerability in calendar.php in ExtCalendar 1.0 and possibly other versions before 2.0 allows remote attackers to inject arbitrary web script or HTML via the 1 year, 2 month, 3 next, and 4 prev parameters...

CVE-2006-1336

CVE-2006-1336 maps to a cross-site scripting vulnerability in ExtCalendar 1.0 (and possibly earlier than 2.0) where calendar.php accepts unvalidated input via the year, month, next, and prev parameters. This can allow remote attackers to inject arbitrary web script or HTML. The connected records ...