CVE-2010-4277: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in lembedded-video.php in the Embedded Video plugin 4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the content parameter to wp-admin/post.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in index.php in TomatoCMS before 2.0.5 allow remote authenticated users, with certain creation privileges, to inject arbitrary web script or HTML via the 1 content parameter in conjunction with a /admin/poll/add PATHINFO, the 2 meta parameter in...

CVE-2010-1996

Multiple cross-site scripting XSS vulnerabilities in index.php in TomatoCMS before 2.0.5 allow remote authenticated users, with certain creation privileges, to inject arbitrary web script or HTML via the 1 content parameter in conjunction with a /admin/poll/add PATHINFO, the 2 meta parameter in...

CVE-2010-1996: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in index.php in TomatoCMS before 2.0.5 allow remote authenticated users, with certain creation privileges, to inject arbitrary web script or HTML via the 1 content parameter in conjunction with a /admin/poll/add PATHINFO, the 2 meta parameter in...

CVE-2010-1528: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in include/template.php in Uiga Proxy, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the content parameter...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Apache Open For Business Project aka OFBiz 09.04 and earlier, as used in Opentaps, Neogia, and Entente Oya, allow remote attackers to inject arbitrary web script or HTML via 1 the productStoreId parameter to control/exportProductListing, 2...

CVE-2009-3747: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in TBmnetCMS 1.0 allows remote attackers to inject arbitrary web script or HTML via the content parameter. NOTE: this was originally reported for tbmnet.php, but that program does not exist in the TBmnetCMS 1.0 distribution...

TBmnetCMS 1.0 Cross Site Scripting

| D R U N K E N | || || || D A N I S H | || || |' R E D N E C K S '--''--''--' RESEARCH AND FUCKING HACKING: | DRUNKEN DANISH REDNECKS | || || || !!!!!!! | || || |' [email protected] '--''--''--' = TBmnetCMS 1.0 XSS | | "content" PARMETER IN tbmnet.php @...

TBmnetCMS <= 1.0 xss

Exploit for unknown platform in category web applications ==================== TBmnetCMS = 1.0 xss ==================== | D R U N K E N | || || || D A N I S H | || || |' R E D N E C K S '--''--''--' RESEARCH AND FUCKING HACKING: | DRUNKEN DANISH REDNECKS | || || || !!!!!!! | || || |' '--''--''--'...

CVE-2008-7039: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/comments.php in Gelato CMS 0.95 allows remote attackers to inject arbitrary web script or HTML via the content parameter in a comment. NOTE: some of these details are obtained from third party information...

CVE-2008-6271: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in TBmnetCMS 1.0, when magicquotesgpc is disabled, allows remote attackers to read arbitrary files via a .. dot dot in the content parameter...

CVE-2008-6190: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in EEBCMS 0.95 allows remote attackers to inject arbitrary web script or HTML via the content parameter...

Directory traversal

Directory traversal vulnerability in include/body.inc.php in Linux Web Shop LWS php Download Manager 1.0 and 1.1 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the content parameter...

CVE-2008-1042

Directory traversal vulnerability in include/body.inc.php in Linux Web Shop LWS php Download Manager 1.0 and 1.1 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the content parameter...

CVE-2008-1051: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in include/bodycomm.inc.php in phpProfiles 4.5.2 BETA allows remote attackers to execute arbitrary PHP code via a URL in the content parameter...

PT-2007-3644 · Bloofox · Bloofoxcms

Name of the Vulnerable Software and Affected Versions: BlooFoxCMS version 0.2.2 Description: The issue concerns a PHP remote file inclusion vulnerability in the install/index.php file of BlooFoxCMS. This vulnerability potentially allows remote attackers to execute arbitrary PHP code via a URL in...

CVE-2007-2082

Direct static code injection vulnerability in admin/settings.php in MyBlog 0.9.8 and earlier allows remote authenticated admin users to inject arbitrary PHP code via the content parameter, which can be executed by accessing index.php. NOTE: a separate vulnerability could be leveraged to make this...

CVE-2007-2082: Undefined Security Weakness

Direct static code injection vulnerability in admin/settings.php in MyBlog 0.9.8 and earlier allows remote authenticated admin users to inject arbitrary PHP code via the content parameter, which can be executed by accessing index.php. NOTE: a separate vulnerability could be leveraged to make this...

CVE-2006-4915

CVE-2006-4915 describes a Cross-site scripting (XSS) vulnerability in index.php of Innovate Portal 2.0, exploitable by injecting arbitrary web script/HTML via the content parameter. According to the linked sources, the vulnerability is non-authenticated (per CVSS: network attack vector, no user a...

CVE-2006-4915: Undefined Security Weakness

Cross-site scripting XSS vulnerability in index.php in Innovate Portal 2.0 allows remote attackers to inject arbitrary web script or HTML via the content parameter...