CVE-2007-1140: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in edit.php in pheap allows remote attackers to read and modify arbitrary files via a .. dot dot in the filename parameter...

CVE-2007-0526: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Bitweaver 1.3.1 allow remote attackers to inject arbitrary web script or HTML via the URL PATHINFO to 1 articles/edit.php, 2 articles/list.php, 3 blogs/listblogs.php, or 4 blogs/rankings.php...

CVE-2006-6925: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in bitweaver 1.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the message title field when submitting an article to articles/edit.php, 2 the message title field when submitting a blog post to blogs/post.php, or...

CVE-2006-6016

wp-admin/user-edit.php in WordPress before 2.0.5 allows remote authenticated users to read the metadata of an arbitrary user via a modified userid parameter...

CVE-2006-6016

CVE-2006-6016 affects WordPress components prior to 2.0.5. A remote authenticated user can access the metadata of arbitrary users by modifying the user_id parameter on wp-admin/user-edit.php. The underlying issue exposes partial confidentiality and is triggered by insufficient access control for ...

CVE-2006-6016: Out-of-bounds Read

wp-admin/user-edit.php in WordPress before 2.0.5 allows remote authenticated users to read the metadata of an arbitrary user via a modified userid parameter...

[ECHO_ADV_55$2006]Phpmybibli <=2.1 Multiple Remote File Inclusion Vulnerability

ECHOADV55$2006 ------------------------------------------------------------------------ ----------------------- ECHOADV55$2006Phpmybibli =2.1 Multiple Remote File Inclusion Vulnerability ------------------------------------------------------------------------ ----------------------- Author : Dedi...

CVE-2006-5402: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in PHPmybibli 3.0.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the 1 classpath, 2 javascriptpath, and 3 includepath parameters in a cart.php; the 4 classpath parameter in b index.php; the 5 javascriptpath...

CVE-2006-4785: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in blog/edit.php in Moodle 1.6.1 and earlier allows remote attackers to execute arbitrary SQL commands via the format parameter as stored in the $blogEntry variable, which is not properly handled by the insertrecord function, which calls adodbcolumnsql in the adodb lay...

CVE-2006-4208

Directory traversal vulnerability in wp-db-backup.php in Skippy WP-DB-Backup plugin for WordPress 1.7 and earlier allows remote authenticated users with administrative privileges to read arbitrary files via a .. dot dot in the backup parameter to edit.php...

CVE-2006-3063

The CVE-2006-3063 entry describes multiple cross-site scripting (XSS) vulnerabilities in myPHP Guestbook 1.x through 2.0.0-r1 and prior to 2.0.1 RC5. The flaw allows remote attackers to inject arbitrary script or HTML via user-supplied content in specific parameters across multiple pages: (a) ind...

CVE-2006-3063: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in myPHP Guestbook 1.x through 2.0.0-r1 and before 2.0.1 RC5 allow remote attackers to inject arbitrary web script or HTML via the 1 comment, 2 email, 3 homepage, 4 id, 5 name, and 6 text parameters in a index.php, the 7 comment, 8 email, 9...

Default credentials

Dmx Forum 2.1a allows remote attackers to obtain username and password information via a direct request to pops/edit.php with a modified membre parameter...

CVE-2006-2947

Dmx Forum 2.1a allows remote attackers to obtain username and password information via a direct request to pops/edit.php with a modified membre parameter...

CVE-2006-2947: Undefined Security Weakness

Dmx Forum 2.1a allows remote attackers to obtain username and password information via a direct request to pops/edit.php with a modified membre parameter...

CVE-2006-2757

Cross-site scripting XSS vulnerability in Chipmunk guestbook allows remote attackers to inject arbitrary web script or HTML via the 1 start parameter in a index.php; 2 forumID parameter in index.php, b newtopic.php, and c reply.php; and 3 ID parameter to d edit.php...

Cross site scripting

Cross-site scripting XSS vulnerability in Chipmunk guestbook allows remote attackers to inject arbitrary web script or HTML via the 1 start parameter in a index.php; 2 forumID parameter in index.php, b newtopic.php, and c reply.php; and 3 ID parameter to d edit.php...

CVE-2006-2757

Cross-site scripting XSS vulnerability in Chipmunk guestbook allows remote attackers to inject arbitrary web script or HTML via the 1 start parameter in a index.php; 2 forumID parameter in index.php, b newtopic.php, and c reply.php; and 3 ID parameter to d edit.php...

CVE-2006-2757: Undefined Security Weakness

Cross-site scripting XSS vulnerability in Chipmunk guestbook allows remote attackers to inject arbitrary web script or HTML via the 1 start parameter in a index.php; 2 forumID parameter in index.php, b newtopic.php, and c reply.php; and 3 ID parameter to d edit.php...

Sql injection

SQL injection vulnerability in @1 File Store 2006.03.07 allows remote attackers to execute arbitrary SQL commands via the id parameter to 1 functions.php and 2 user.php in the libs directory, 3 edit.php and 4 delete.php in control/files/, 5 edit.php and 6 delete.php in control/users/, 7 edit.php,...