976 matches found
Sql injection
SQL injection vulnerability in imagegallery.php in the Akira Powered Image Gallery imagegallery plugin 0.9.6.2 for e107 allows remote attackers to execute arbitrary SQL commands via the image parameter in an image-detail action...
CVE-2008-6466
SQL injection vulnerability in imagegallery.php in the Akira Powered Image Gallery imagegallery plugin 0.9.6.2 for e107 allows remote attackers to execute arbitrary SQL commands via the image parameter in an image-detail action...
CVE-2008-6466
The CVE-2008-6466 entry describes an SQL injection vulnerability in the Akira Powered Image Gallery (image_gallery) plugin for e107, specifically in image_gallery.php version 0.9.6.2. An attacker can supply a crafted image parameter in an image-detail action to execute arbitrary SQL commands on t...
CVE-2008-6438
SQL injection vulnerability in macgurublogmenu/macgurublog.php in the MacGuru BLOG Engine plugin 2.2 for e107 allows remote attackers to execute arbitrary SQL commands via the uid parameter, a different vector than CVE-2008-2455. NOTE: it was later reported that 2.1.4 is also affected...
CVE-2008-6438
The provided data confirms a concrete SQL injection vulnerability in the MacGuru BLOG Engine plugin for e107 (MacGuru Blog Engine). Affected component: macgurublog_menu/macgurublog.php (v2.2, with note that 2.1.4 is also affected) and, per related entries, comment.php. Root cause: unsanitized inp...
E107 CMS (e107_plugins/guestbook) stored XSS
Фильтрация отсутствует в поле "Email", POST запрос: POSTDATA=name=1&email='/"scriptalert'xss'/script&url=http3A2F2F&comment=4&guestbooksubmit=SiC5B3sti Далее следует редактирование сообщения. http://Target/e107plugins/guestbook/guestbook.php?edit.номер вашего сообщения Example:...
Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc. Drupal: Crossite scripting. E107: crossite scripting...
Cross site scripting
Cross-site scripting XSS vulnerability in submitnews.php in e107 CMS 0.7.11 allows remote attackers to inject arbitrary web script or HTML via the 1 authorname, 2 itemtitle, and 3 item parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third part...
CVE-2008-6208
Cross-site scripting XSS vulnerability in submitnews.php in e107 CMS 0.7.11 allows remote attackers to inject arbitrary web script or HTML via the 1 authorname, 2 itemtitle, and 3 item parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third part...
CVE-2008-6208
CVE-2008-6208 is an XSS vulnerability in e107 CMS 0.7.11 affecting submitnews.php. The vulnerability enables remote attackers to inject arbitrary script/HTML via the (1) author_name, (2) itemtitle, and (3) item parameters. The NVD entry notes the vulnerability as XSS with a medium base score (4.3...
Sql injection
SQL injection vulnerability in productdetails.php in the Mytipper Zogo-shop 1.15.4 plugin for e107 allows remote attackers to execute arbitrary SQL commands via the product parameter...
CVE-2008-6114
SQL injection vulnerability in productdetails.php in the Mytipper Zogo-shop 1.15.4 plugin for e107 allows remote attackers to execute arbitrary SQL commands via the product parameter...
CVE-2008-6114
CVE-2008-6114 affects the Mytipper Zogo-shop 1.15.4 plugin for e107. The vulnerability is a SQL injection in product_details.php, exploitable via the product parameter, allowing remote attackers to execute arbitrary SQL commands. Affected component: the plugin’s product_details.php; root cause is...
CVE-2008-6114
SQL injection vulnerability in productdetails.php in the Mytipper Zogo-shop 1.15.4 plugin for e107 allows remote attackers to execute arbitrary SQL commands via the product parameter...
CVE-2008-6069
SQL injection vulnerability in e107chat.php in the eChat plugin 4.2 for e107, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the nick parameter...
CVE-2008-6069
CVE-2008-6069 describes an SQL injection in the eChat plugin 4.2 for e107, via the nick parameter in e107chat.php, when magic_quotes_gpc is disabled. The issue is exploitable remotely over the network (as per the NVD vector), potentially impacting confidentiality, integrity, and availability (par...
Vulnerabilities in E107
Здравствуйте 3APA3A! Сообщаю вам о найденных мною Insufficient Anti-automation и Cross-Site Scripting уязвимостях в системе E107. Insufficient Anti-automation: Уязвимости в капче на странице отправки ссылки на новость. Которая уязвима к полуавтоматическому методу обхода...
Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc. E107: обход CAPTCHA, межсайтовый скриптинг...