CVE-2011-3371: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in include/functions.php in PunBB before 1.3.6 allow remote attackers to inject arbitrary web script or HTML via the 1 id, 2 formsent, 3 csrftoken, 4 reqconfirm, or 5 delete parameter to delete.php, the 6 id, 7 formsent, 8 csrftoken, 9 reqmessage,...

CVE-2010-0989

Pulse CMS contains a directory traversal vulnerability in delete.php (f parameter) affecting versions prior to 1.2.3. Exploitation allows remote authenticated users to delete arbitrary files on the server via directory traversal sequences. Severity is evidenced as moderately critical in Secunia’s...

CVE-2010-0989

Directory traversal vulnerability in delete.php in Pulse CMS before 1.2.3 allows remote authenticated users to delete arbitrary files via directory traversal sequences in the f parameter...

CVE-2010-0989: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in delete.php in Pulse CMS before 1.2.3 allows remote authenticated users to delete arbitrary files via directory traversal sequences in the f parameter...

CVE-2008-7181: Undefined Security Weakness

Butterfly Organizer 2.0.0 allows remote attackers to 1 delete arbitrary categories via a modified tablehere parameter to category-delete.php with the isjsconfirmed parameter set to 1, or 2 delete arbitrary accounts via the mytable parameter to delete.php...

CVE-2009-2608: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in PHP Address Book 4.0.x allow remote attackers to execute arbitrary SQL commands via the 1 id parameter to delete.php or 2 alphabet parameter to index.php. NOTE: the edit.php and view.php vectors are already covered by CVE-2008-2565...

Podcast Generator 1.2 Re-Installation

$file.$ext $Ldeleted"; / Explanation code snippet above points ----------------------------------------------------------------------------------- 1. blocks all 'amilogged' REQUEST variables,what about GLOBALS?,therefore useless! 2. if 'amilogged' isn't true - exit function activated. 3. unlink...

Podcast Generator 1.2 - Unauthorized Re-Installation

$file.$ext $Ldeleted"; / Explanation code snippet above points ----------------------------------------------------------------------------------- 1. blocks all 'amilogged' REQUEST variables,what about GLOBALS?,therefore useless! 2. if 'amilogged' isn't true - exit function activated. 3. unlink...

Podcast Generator <= 1.2 unauthorized Re-Installation Remote Exploit

Exploit for unknown platform in category web applications ==================================================================== Podcast Generator $file.$ext $Ldeleted"; / Explanation code snippet above points ----------------------------------------------------------------------------------- 1...

CVE-2008-6743: Improper Authentication

RSMScript 1.21 allows remote attackers to bypass authentication and gain administrative privileges by setting the verified cookie to an arbitrary value and performing a direct request to 1 delete.php, 2 edit-submit.php, 3 edit.php, 4 submit.php, and 5 update.php, which bypasses the security check...

CVE-2009-1226: Undefined Security Weakness

core/admin/delete.php in Podcast Generator 1.1 and earlier does not properly restrict access to administrative functions, which allows remote attackers to delete arbitrary files via the file parameter...

Server side request forgery (ssrf)

delete.php in Max.Blog 1.0.6 does not properly restrict access, which allows remote attackers to delete arbitrary blog posts via a direct request...

CVE-2009-0383

delete.php in Max.Blog 1.0.6 does not properly restrict access, which allows remote attackers to delete arbitrary blog posts via a direct request...

CVE-2009-0383

delete.php in Max.Blog 1.0.6 does not properly restrict access, which allows remote attackers to delete arbitrary blog posts via a direct request...

CVE-2009-0383

CVE-2009-0383 affects Max.Blog 1.0.6; the delete.php endpoint does not properly restrict access, enabling remote attackers to delete arbitrary blog posts via a direct request. The issue is caused by improper access control on the delete operation. Impact is partial integrity/partial availability ...

CVE-2009-0383: Undefined Security Weakness

delete.php in Max.Blog 1.0.6 does not properly restrict access, which allows remote attackers to delete arbitrary blog posts via a direct request...

CVE-2008-4757: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in PHP-Daily allow remote attackers to execute arbitrary SQL commands via the 1 id parameter to a addpostit.php b delete.php, and c modprestdate.php; and the 2 prev parameter to d prestdetail.php...

Sports Clubs Web Panel 0.0.1 - Remote Game Delete

!/usr/bin/perl -W Sports Clubs Web Panel 0.0.1 Remote Game Delete Exploit File affected: include/draw-delete.php id Vuln Code: 06: $did = $GET'id'; 08: mysqlquery"DELETE FROM draw WHERE did='$did'"; by ka0x D.O.M Labs - Security Researchers - www.domlabs.org - ka0x@domlabs:/codes$ ./sportspanel.p...

Sports Clubs Web Panel 0.0.1 Remote Game Delete Exploit

Exploit for unknown platform in category web applications ======================================================= Sports Clubs Web Panel 0.0.1 Remote Game Delete Exploit ======================================================= !/usr/bin/perl -W Sports Clubs Web Panel 0.0.1 Remote Game Delete Explo...

CVE-2008-3302

CVE-2008-3302 describes an SQL injection in BilboBlog 0.2.1. The vulnerability exists in admin/delete.php when magic_quotes_gpc is disabled, allowing remote authenticated administrators to execute arbitrary SQL commands via the num parameter. Public references confirm the affected component and c...