CVE-2008-7213: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in mambots/editors/mostlyce/jscripts/tinymce/filemanager/connectors/php/connector.php in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to inject arbitrary web script or HTML via the Command parameter...

CVE-2008-7212: Undefined Security Weakness

MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to obtain sensitive information via certain requests to mambots/editors/mostlyce/jscripts/tinymce/filemanager/connectors/php/connector.php, which reveals the installation path in an error message...

CVE-2008-6620: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in javascript/editor/editor/filemanager/browser/mcpuk/connectors/php/connector.php in GraFX miniCWB 2.1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 errcontext, 2 GET, 3 POST, 4 SESSION, 5 SERVER, and 6...

FCKeditor connector.php任意文件上传漏洞

BUGTRAQ ID: 31812 CVECAN ID: CVE-2008-6178 FCKeditor是一款开放源码的HTML文本编辑器。 FCKeditor的editor/filemanager/browser/default/connectors/php/connector.php模块中存在文件上传限制漏洞： 147. function FileUpload $resourceType, $currentFolder 148. 149. $sErrorNumber = '0' ; 150. $sFileName = '' ; 151. 152. if isset...

CVE-2008-6178: Improper Control of Generation of Code

Unrestricted file upload vulnerability in editor/filemanager/browser/default/connectors/php/connector.php in FCKeditor 2.2, as used in Falt4 CMS, Nuke ET, and other products, allows remote attackers to execute arbitrary code by creating a file with PHP sequences preceded by a ZIP header, uploadin...

CVE-2008-3712: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Mambo 4.6.2 and 4.6.5, when registerglobals is enabled, allow remote attackers to inject arbitrary web script or HTML via the 1 query string to mambots/editors/mostlyce/jscripts/tinymce/filemanager/connectors/php/connector.php and the 2...

CVE-2008-3568

Absolute path traversal vulnerability in fckeditor/editor/filemanager/browser/default/connectors/php/connector.php in UNAK-CMS 1.5.5 allows remote attackers to include and execute arbitrary local files via a full pathname in the Dirroot parameter, a different vulnerability than CVE-2006-4890.1...

CVE-2008-3568: Improper Limitation of a Pathname to a Restricted Directory

Absolute path traversal vulnerability in fckeditor/editor/filemanager/browser/default/connectors/php/connector.php in UNAK-CMS 1.5.5 allows remote attackers to include and execute arbitrary local files via a full pathname in the Dirroot parameter, a different vulnerability than CVE-2006-4890.1...

UNAK-CMS 1.5 - 'connector.php' Local File Inclusion

source: https://www.securityfocus.com/bid/30533/info UNAK-CMS is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability using directory-traversal strings to view local files within the context of the...

miniCWB connector.php多个跨站脚本漏洞

BUGTRAQ ID: 29368 miniCWB是一款小型的开源内容管理系统。 Mini CWB没有正确过滤对/javascript/editor/editor/filemanager/browser/mcpuk/connectors/php/connector.php所传送的URL便返回给了用户，这允许远程攻击者通过跨站脚本攻击在用户浏览器会话中执行任意代码。 GraFX miniCWB = 2.1.1 GraFX ----- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.mini-open-cms.com/...

minicwb-xss.txt

========================================================== Mini-CWB - http://target/minicwbpath/javascript/editor/editor/filemanager/browser/mcpuk/connectors/php/connector.php?GET= - http://target/minicwbpath/javascript/editor/editor/filemanager/browser/mcpuk/connectors/php/connector.php?POST= -...

miniCWB 2.1.1 - connector.php Multiple Cross-Site Scripting Vulnerabilities

miniCWB 2.1.1 - connector.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/29368/info miniCWB is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to...

CVE-2006-4890: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in UNAK-CMS 1.5 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the dirroot parameter to 1 fckeditor/editor/filemanager/browser/default/connectors/php/connector.php or 2 fckeditor/editor/dialog/fcklink.php...

CVE-2006-3362: Undefined Security Weakness

Unrestricted file upload vulnerability in connectors/php/connector.php in FCKeditor mcpuk file manager, as used in 1 Geeklog 1.4.0 through 1.4.0sr3, 2 toendaCMS 1.0.0 Shizouka Stable and earlier, 3 WeBid 0.5.4, and possibly other products, when installed on Apache with modmime, allows remote...

GeekLog 1.4.0sr3 - f(u)ckeditor Remote Code Execution

GeekLog 1.4.0sr3 - fuckeditor Remote Code Execution !/usr/bin/php -q -d shortopentag=on 126 $result.=" ."; else $result.=" ".$string$i; if strlendechexord$string$i==2 $exa.=" ".dechexord$string$i; else $exa.=" 0".dechexord$string$i; $cont++;if $cont==15 $cont=0; $result.="\r\n"; $exa.="\r\n";...

CVE-2006-0922

CubeCart 3.0 through 3.6 does not properly check authorization for an administration session because of a missing auth.inc.php include, which results in an absolute path traversal vulnerability in FileUpload in connector.php aka upload.php that allows remote attackers to upload arbitrary files vi...

Directory traversal

Multiple directory traversal vulnerabilities in connector.php in FCKeditor 2.0 FC, as used in products such as RunCMS, allow remote attackers to list and create arbitrary directories via a .. dot dot in the CurrentFolder parameter to 1 GetFoldersAndFiles and 2 CreateFolder...

CVE-2006-0922

CubeCart 3.0 through 3.6 does not properly check authorization for an administration session because of a missing auth.inc.php include, which results in an absolute path traversal vulnerability in FileUpload in connector.php aka upload.php that allows remote attackers to upload arbitrary files vi...

CVE-2006-0921

CVE-2006-0921 involves multiple directory traversal vulnerabilities in connector.php of FCKeditor 2.0 FC, used in products such as RunCMS. The issue allows remote attackers to list and create arbitrary directories by sending a .. payload in the CurrentFolder parameter to GetFoldersAndFiles and Cr...

CVE-2006-0921: Undefined Security Weakness

Multiple directory traversal vulnerabilities in connector.php in FCKeditor 2.0 FC, as used in products such as RunCMS, allow remote attackers to list and create arbitrary directories via a .. dot dot in the CurrentFolder parameter to 1 GetFoldersAndFiles and 2 CreateFolder...