Cross site scripting

Cross-site scripting vulnerability in calendar.php in ExtCalendar 1.0 and possibly other versions before 2.0 allows remote attackers to inject arbitrary web script or HTML via the 1 year, 2 month, 3 next, and 4 prev parameters...

CVE-2006-1336

CVE-2006-1336 maps to a cross-site scripting vulnerability in ExtCalendar 1.0 (and possibly earlier than 2.0) where calendar.php accepts unvalidated input via the year, month, next, and prev parameters. This can allow remote attackers to inject arbitrary web script or HTML. The connected records ...

CVE-2006-1336: Undefined Security Weakness

Cross-site scripting vulnerability in calendar.php in ExtCalendar 1.0 and possibly other versions before 2.0 allows remote attackers to inject arbitrary web script or HTML via the 1 year, 2 month, 3 next, and 4 prev parameters...

CVE-2006-1120: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in DCP-Portal 6.1.1 and earlier, with registerglobals enabled, allow remote attackers to inject arbitrary web script or HTML via the 1 itsurl parameter in the documents page and 2 url parameter in the sendwrite page of a index.php; 3 subject, and ...

DCP Portal: Multiple XSS Vulnerabilities

=========================================================== DCP Portal: Multiple XSS Vulnerabilities =========================================================== Technical University of Vienna Security Advisory TUVSA-0603-001, March 9, 2006 =========================================================...

CVE-2006-0770

CVE-2006-0770 concerns a delivered XSS vulnerability in the MyBB (MyBulletinBoard) package, specifically in calendar.php of version 1.0.4. The issue arises when a URL is not properly sanitized and is returned as a link in the advanced details, allowing remote attackers to inject arbitrary web scr...

CVE-2006-0770

Cross-site scripting XSS vulnerability in calendar.php in MyBulletinBoard MyBB 1.0.4 allows remote attackers to inject arbitrary web script or HTML via a URL that is not sanitized before being returned as a link in "advanced details". NOTE: the provenance of this information is unknown; the detai...

CVE-2006-0770: Undefined Security Weakness

Cross-site scripting XSS vulnerability in calendar.php in MyBulletinBoard MyBB 1.0.4 allows remote attackers to inject arbitrary web script or HTML via a URL that is not sanitized before being returned as a link in "advanced details". NOTE: the provenance of this information is unknown; the detai...

CVE-2006-0610: Undefined Security Weakness

Multiple SQL injection vulnerabilities in 2200net Calendar system 1.2, with gpcmagicquotes disabled, allow remote attackers to execute arbitrary SQL commands and bypass authentication via 1 the fmdataid parameter to calendar.php and 2 the $ad'acc' variable in adminlogin.php...

dcpXSS.txt

NightWarrior nightwarrior771athotmail.com DCP Portal Cross-Site Scripting Vulnerability http://www.dcp-portal.org http://vicktimhost/calendar.php?show=fullmonth&s=1&submit=GO&day=XSS http://vicktimhost/search.php post this code alert'nightwarrior';...

CVE-2006-0220: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in DCP-Portal 5.3 through 6.1.1 allow remote attackers to inject arbitrary web script or HTML via 1 the day parameter in calendar.php and 2 the input form in search.php. NOTE: the provenance of this information is unknown; the details are obtained...

CVE-2005-4642: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in HydroBB 1.0.0 Beta 2 allow remote attackers to inject arbitrary web script or HTML via the s parameter to 1 search.php, 2 members.php, 3 stats.php, 4 viewforum.php, 5 register.php, 6 usercp.php, 7 groups.php, 8 pms.php, and 9 calendar.php...

Cross site scripting

Cross-site scripting XSS vulnerability in vBulletin 3.5.2, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via the title of an event, which is not properly filtered by 1 calendar.php and 2 reminder.php...

CVE-2006-0080: Undefined Security Weakness

Cross-site scripting XSS vulnerability in vBulletin 3.5.2, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via the title of an event, which is not properly filtered by 1 calendar.php and 2 reminder.php...

CVE-2005-4642

Multiple cross-site scripting XSS vulnerabilities in HydroBB 1.0.0 Beta 2 allow remote attackers to inject arbitrary web script or HTML via the s parameter to 1 search.php, 2 members.php, 3 stats.php, 4 viewforum.php, 5 register.php, 6 usercp.php, 7 groups.php, 8 pms.php, and 9 calendar.php...

MyBB calendar.php 'month' Parameter SQLi

The version of MyBB installed on the remote host is affected by a SQL injection vulnerability due to improper sanitization of user-supplied input to the 'month' parameter of the calendar.php script. A remote, unauthenticated attacker can exploit this issue to manipulate SQL queries, resulting in...

CVE-2005-4227: Undefined Security Weakness

Multiple "potential" SQL injection vulnerabilities in DCP-Portal 6.1.1 might allow remote attackers to execute arbitrary SQL commands via 1 the password and username parameters in advertiser.php, 2 the aid parameter in announcement.php, 3 the dcp5memberid, year, agid, day, days, hour, minute,...

CVE-2005-4199

MyBB prior to 1.0 is affected by multiple SQL injection vulnerabilities. The public details identify concrete vectors, notably the month parameter in calendar.php (SQLi), and additional parameters in usercp.php, member.php, and showthread/ratethread.php. This is a documented remote, unauthenticat...

CVE-2005-4199: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in MyBulletinBoard MyBB before 1.0 allow remote attackers to execute arbitrary SQL commands via the 1 month, 2 day, and 3 year parameters in an addevent action in calendar.php; 4 threadmode and 5 showcodebuttons in an options action in usercp.php; 6 list...

CVE-2005-4139

Multiple SQL injection vulnerabilities in ThWboard before 3 Beta 2.84 allow remote attackers to execute arbitrary SQL commands via the 1 year parameter in calendar.php, 2 user parameter array in vprofile.php, and 3 the userid parameter in misc.php...