CVE-2014-9303

EntryPass N5200 Active Network Control Panel allows remote attackers to read device memory and obtain the administrator username and password via a URL starting with an ASCII character o through z or A through D, different vectors than CVE-2014-8868...

CVE-2009-4209

Multiple cross-site scripting XSS vulnerabilities in admin/index.php in moziloCMS 1.11.1 allow remote attackers to inject arbitrary web script or HTML via the 1 cat and 2 file parameters in an editsite action, different vectors than CVE-2008-6127 and CVE-2009-1367...

CVE-2008-6631

Multiple cross-site scripting XSS vulnerabilities in index.php in BlogPHP 2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 user parameter in a sendmessage action and the 2 username parameter when registering a new user, different vectors than CVE-2008-0679...

Directory traversal

Directory traversal vulnerability in index.php in Jaws 0.8.8 allows remote authenticated users to read arbitrary files via a .. dot dot in the 1 language, 2 Introductioncomplete, and 3 uselog parameters, different vectors than CVE-2004-2445...

CVE-2008-0545

CVE-2008-0545 describes multiple directory traversal vulnerabilities in Bubbling Library 1.32. The issue allows remote attackers to include and execute arbitrary local files via a .. in the uri parameter passed to dispatcher/framework/ templates (yui-menu.tpl.php, simple.tpl.php, advanced.tpl.php...

CVE-2007-5728

Cross-site scripting XSS vulnerability in phpPgAdmin 3.5 to 4.1.1, and possibly 4.1.2, allows remote attackers to inject arbitrary web script or HTML via certain input available in PHPSELF in 1 redirect.php, possibly related to 2 login.php, different vectors than CVE-2007-2865...

Sql injection

Multiple SQL injection vulnerabilities in All In One Control Panel AIOCP 1.3.010 and earlier, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 xusername parameter to shared/code/cpauthorization.php, and the 2 did parameter to...

PT-2006-2739 · Vwar · Virtual War

PHP remote file inclusion vulnerability in Virtual War VWar 1.5.0 allows remote attackers to execute arbitrary PHP code via a URL in the vwar root parameter to 1 admin/admin.php, 2 war.php, 3 stats.php, 4 news.php, 5 joinus.php, 6 challenge.php, 7 calendar.php, 8 member.php, 9 popup.php, and othe...