Directory traversal

Multiple directory traversal vulnerabilities in FocalMedia.Net Quick Polls before 1.0.2 allow remote attackers to 1 read arbitrary files via a .. dot dot in the p parameter in a preview action to index.php, or 2 delete arbitrary files via a .. dot dot in the p parameter in a delete action to...

CVE-2011-1099

Multiple directory traversal vulnerabilities in FocalMedia.Net Quick Polls before 1.0.2 allow remote attackers to 1 read arbitrary files via a .. dot dot in the p parameter in a preview action to index.php, or 2 delete arbitrary files via a .. dot dot in the p parameter in a delete action to...

CVE-2011-0437

shared/inc/sql/ssh.php in the SSH accounts management implementation in Domain Technologie Control DTC before 0.32.9 allows remote authenticated users to delete arbitrary accounts via the edsshaccount parameter in a deletesshaccount Delete action...

CVE-2009-3582

Multiple SQL injection vulnerabilities in the delete subroutine in SQL-Ledger 2.8.24 allow remote authenticated users to execute arbitrary SQL commands via the 1 id and possibly 2 db parameters in a Delete action to the output of a VendorsReportsSearch search operation...

Deserialization of untrusted data

comments.php in Simplog 0.9.3.2, and possibly earlier, does not properly restrict access, which allows remote attackers to edit or delete comments via the 1 edit or 2 del action...

CVE-2008-7192

Cross-site request forgery CSRF vulnerability in index.php in WoltLab Burning Board wBB 3.0.1, and possibly other 3.x versions, allows remote attackers to hijack the authentication of users for requests that delete private messages via the pmID parameter in a delete action in a PM page, a differe...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Pivot 1.40.4 and 1.40.7 allow remote attackers to inject arbitrary web script or HTML via the 1 menu or 2 sort parameter to pivot/index.php, 3 the value of a check array parameter in a delete action to pivot/index.php, 4 the element name in a...

CVE-2009-2133

Multiple cross-site scripting XSS vulnerabilities in Pivot 1.40.4 and 1.40.7 allow remote attackers to inject arbitrary web script or HTML via the 1 menu or 2 sort parameter to pivot/index.php, 3 the value of a check array parameter in a delete action to pivot/index.php, 4 the element name in a...

CVE-2008-6314

SQL injection vulnerability in tagboard.php in the Tag Board module 4.0 and earlier for phpBB allows remote attackers to execute arbitrary SQL commands via the id parameter in a delete action...

CVE-2008-6314: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in tagboard.php in the Tag Board module 4.0 and earlier for phpBB allows remote attackers to execute arbitrary SQL commands via the id parameter in a delete action...

CVE-2008-6301

SQL injection vulnerability in shoutboxview.php in the Small ShoutBox module 1.4 for phpBB allows remote attackers to execute arbitrary SQL commands via the id parameter in a delete action...

CVE-2008-6301

SQL injection vulnerability in shoutboxview.php in the Small ShoutBox module 1.4 for phpBB allows remote attackers to execute arbitrary SQL commands via the id parameter in a delete action...

CVE-2008-6301: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in shoutboxview.php in the Small ShoutBox module 1.4 for phpBB allows remote attackers to execute arbitrary SQL commands via the id parameter in a delete action...

CVE-2008-3716: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in Harmoni before 1.6.0 allows remote attackers to make administrative modifications via a 1 save or 2 delete action to an unspecified component...

CVE-2007-1363

Multiple SQL injection vulnerabilities in DropAFew before 0.2.1 allow remote attackers to execute arbitrary SQL commands via the 1 id parameter in the delete action in a search.php or b search-pda.php, or the 2 calories parameter in a save action in editlogcal.php...

DropAFew 0.2 - search.php?delete Action id SQL Injection

DropAFew 0.2 - search.php?delete Action id SQL Injection source: https://www.securityfocus.com/bid/23400/info DropAFew is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could all...

DEBIAN-CVE-2007-1244

Cross-site request forgery CSRF vulnerability in the AdminPanel in WordPress 2.1.1 and earlier allows remote attackers to perform privileged actions as administrators, as demonstrated using the delete action in wp-admin/post.php. NOTE: this issue can be leveraged to perform cross-site scripting X...

PT-2005-1333 · Biborb · Biborb

Name of the Vulnerable Software and Affected Versions: BibORB versions 1.3.2 and earlier Description: The issue allows remote attackers to delete arbitrary files via a Delete action and .. dot dot sequences in the database name parameter in index.php. Recommendations: For BibORB versions 1.3.2 an...