U-Mail Webmail 4.91 - edit.php Arbitrary File Write

U-Mail Webmail 4.91 - edit.php Arbitrary File Write U-Mail Webmail Arbitrary File Write Vulnerability ================================================== Vulnerable: U-Mail 4.91 Vendors: www.comingchina.com Category: Input Validation Error Impact: An attacker can write arbitrary data to new files...

mini-pub 0.3 - Local Directory Traversal File Disclosure

mini-pub 0.3 - Local Directory Traversal File Disclosure | | | \ \ \ / / / \ / | / | / | | | | | | \ V / / \ | | | | | | | | | | | / \ | || | | | | | || || \ || // \ | | | mini-pub.php = v0.3 Local Directory Traversal / File Disclosure Vulnerabilities Script : http://mini-pub.sourceforge.net/...

CVE-2008-4499

Multiple directory traversal vulnerabilities in PHP Web Explorer 0.99b and earlier allow remote attackers to include and execute arbitrary local files via a .. dot dot in the 1 refer parameter to main.php and the 2 file parameter to edit.php...

CVE-2008-4499: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in PHP Web Explorer 0.99b and earlier allow remote attackers to include and execute arbitrary local files via a .. dot dot in the 1 refer parameter to main.php and the 2 file parameter to edit.php...

phpwebexplorer-lfi.txt

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- PHPWebExplorer eNYe-Sec - www.enye-sec.org -- Exploit -- If you have access to the control panel: http://localhost/main.php?refer=d&d=../../../etc http://localhost/edit.php?file=../../../etc/passwd If you are not a register user but you...

CVE-2008-4337: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Bitweaver 2.0.2 allows remote attackers to inject arbitrary web script or HTML via the URL parameter to 1 edit.php and 2 list.php in articles/; 3 listblogs.php and 4 rankings.php in blogs/; 5 calendar/index.php; 6 calendar.php, 7 index.php, and 8...

CVE-2008-4175: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Link Bid Script 1.5 allow remote attackers to execute arbitrary SQL commands via the 1 ucat parameter to upgrade.php and the 2 id parameter to linkadmin/edit.php...

linkbid-sql.txt

Link Bid Script 1.5 Multiple Remote SQL Injection + Discovered By SirGod + wWw.MorTal-TeaM.OrG + Greetz : E.M.I.N.E.M,Ras,Puscasmarin,ToxicBlood,HrN,kemrayz,007m,Raven,Nytr0gen,str0ke + Remote SQL Injection - Note : For PoC 2 you need administrative rights. PoC 1 :...

sportsclub-sql.txt

...::::: Sports Clubs Web Panel 0.0.1 SQL Injection Vulnerability ::::.... Virangar Security Team www.virangar.net -------- Discoverd By :virangar security teamZahra:zhvirangar special tnx :my master hadihadi tnx to:MR.nosrati,black.shadowes,MR.hesy,Ali007 & all virangar members & all hackerz...

CVE-2008-3326: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in blog/edit.php in Moodle 1.6.x before 1.6.7 and 1.7.x before 1.7.5 allows remote attackers to inject arbitrary web script or HTML via the etitle parameter blog entry title...

CVE-2008-2565: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in PHP Address Book 3.1.5 and earlier allow remote attackers to execute arbitrary SQL commands via the id parameter to 1 view.php and 2 edit.php. NOTE: it was later reported that 4.0.x is also affected...

phpaddress-sqlxss.txt

============================================================ PHP-Address Book SQL/XSS Multiple Remote Vulnerabilities ============================================================ ,--^----------,--------,-----,-------^--, | ||||||||| --------' | O .. CWH Underground Hacking Team...

PHP-Address Book <= 3.1.5 (SQL/XSS) Multiple Vulnerabilities

No description provided by source. ============================================================ PHP-Address Book SQL/XSS Multiple Remote Vulnerabilities ============================================================ ,--^----------,--------,-----,-------^--, | ||||||||| --------' | O .. CWH...

PHP-Address Book 3.1.5 - SQL Injection Cross-Site Scripting

PHP-Address Book 3.1.5 - SQL Injection Cross-Site Scripting ============================================================ PHP-Address Book SQL/XSS Multiple Remote Vulnerabilities ============================================================ ,--^----------,--------,-----,-------^--, | |||||||||...

PHP-Address Book 3.1.5 - SQL Injection / Cross-Site Scripting

============================================================ PHP-Address Book SQL/XSS Multiple Remote Vulnerabilities ============================================================ ,--^----------,--------,-----,-------^--, | ||||||||| --------' | O .. CWH Underground Hacking Team...

Sql injection

Multiple SQL injection vulnerabilities in PacerCMS 0.6 allow remote authenticated users to execute arbitrary SQL commands via the id parameter to 1 siteadmin/article-edit.php; and unspecified parameters to 2 submitted-edit.php, 3 page-edit.php, 4 section-edit.php, 5 staff-edit.php, and 6...

CVE-2008-0451: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in PacerCMS 0.6 allow remote authenticated users to execute arbitrary SQL commands via the id parameter to 1 siteadmin/article-edit.php; and unspecified parameters to 2 submitted-edit.php, 3 page-edit.php, 4 section-edit.php, 5 staff-edit.php, and 6...

Cross site scripting

Cross-site scripting XSS vulnerability in wp-db-backup.php in WordPress 2.0.11 and earlier, and possibly 2.1.x through 2.3.x, allows remote attackers to inject arbitrary web script or HTML via the backup parameter in a wp-db-backup.php action to wp-admin/edit.php...

CVE-2008-0193

Cross-site scripting XSS vulnerability in wp-db-backup.php in WordPress 2.0.11 and earlier, and possibly 2.1.x through 2.3.x, allows remote attackers to inject arbitrary web script or HTML via the backup parameter in a wp-db-backup.php action to wp-admin/edit.php...

CVE-2008-0193

Cross-site scripting XSS vulnerability in wp-db-backup.php in WordPress 2.0.11 and earlier, and possibly 2.1.x through 2.3.x, allows remote attackers to inject arbitrary web script or HTML via the backup parameter in a wp-db-backup.php action to wp-admin/edit.php...