CVE-2013-2618

CVE-2013-2618 affects Network Weathermap: an XSS in editor.php where the map_title parameter can inject arbitrary script/HTML. Vulnerable in versions before 0.97b; remote exploitation reported (e.g., exploit-db). Impact is persistent DOM/script injection as described in multiple advisories; remed...

CVE-2013-3739: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in editor.php in Network Weathermap 0.97c and earlier allows remote attackers to read arbitrary files via a .. dot dot in the mapname parameter in a showconfig action...

CVE-2013-2618: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in editor.php in Network Weathermap before 0.97b allows remote attackers to inject arbitrary web script or HTML via the maptitle parameter...

CVE-2013-2618

Cross-site scripting XSS vulnerability in editor.php in Network Weathermap before 0.97b allows remote attackers to inject arbitrary web script or HTML via the maptitle parameter. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...

Weathermap 0.97C Local File Inclusion

============================================= WEBERA ALERT ADVISORY 01 - Discovered by: Anthony Dubuissez - Severity: high - CVE Request - 03/06/2013 - CVE Assign - 03/06/2013 - CVE Number - CVE-2013-3739 - Vendor notification - 03/06/2013 - Vendor reply - No reply - Public disclosure - 10/06/201...

iScripts EasyCreate CMS v2.0 - Multiple Web Vulnerabilites

Title: ====== iScripts EasyCreate CMS v2.0 - Multiple Web Vulnerabilites Date: ===== 2012-06-02 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=588 VL-ID: ===== 588 Common Vulnerability Scoring System: ==================================== 8.3 Introduction: =============...

Uebimiau Web-Mail <= v3.2.0-1.8 Remote File / Overwrite Vulnerabilities

No description provided by source. Uebimiau Webmail = v3.2.0-1.8 Remote File / Overwrite Vulnerabilities Dork : Uebimiau Webmail v3.2.0-1.8 POC : /uebimiau/admin/editor.php?load=config And You Can Write Any Code As ?php passthru$GETcmd; ? After That Click Write To File Go /uebimiau/index.php?cmd=...

phpWebThings editor_insert_bottom Parameter Remote File Include Vulnerability

The remote web server contains a PHP script that is affected by a remote file include issue. Description: The remote web server is running phpWebThings, a PHP based photo gallery management system. The version of phpWebThings installed on the remote host fails to sanitize input to the...

Directory traversal

Multiple directory traversal vulnerabilities in editor.php in ScriptsEZ.net Power Editor 2.0 allow remote attackers to read arbitrary local files via a .. dot dot in the 1 te and 2 dir parameters in a tempedit action...

CVE-2008-2115

Multiple cross-site scripting XSS vulnerabilities in editor.php in ScriptsEZ.net Power Editor 2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 te and 2 dir parameters in a tempedit action...

CVE-2008-2116

CVE-2008-2116 affects ScriptsEZ.net Power Editor 2.0: directory traversal in editor.php allows reading arbitrary local files via a .. sequence in the te and dir parameters of the tempedit action. Root cause is improper input handling of path traversal; impact is partial confidentiality/integrity/...

CVE-2008-2115: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in editor.php in ScriptsEZ.net Power Editor 2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 te and 2 dir parameters in a tempedit action...

CVE-2008-2116: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in editor.php in ScriptsEZ.net Power Editor 2.0 allow remote attackers to read arbitrary local files via a .. dot dot in the 1 te and 2 dir parameters in a tempedit action...

CVE-2007-3141

PHP remote file inclusion vulnerability in core/editor.php in phpWebThings 1.5.2 allows remote attackers to execute arbitrary PHP code via a URL in the editorinserttop parameter. NOTE: the editorinsertbottom vector is already covered by CVE-2006-6042...

CVE-2007-3141

CVE-2007-3141 affects phpWebThings 1.5.2: remote code execution via PHP remote file inclusion in core/editor.php through the editor_insert_top parameter. Bottom vector already covered by CVE-2006-6042. The connected docs confirm the vulnerability but do not provide a remediation.

CVE-2007-3141: Undefined Security Weakness

PHP remote file inclusion vulnerability in core/editor.php in phpWebThings 1.5.2 allows remote attackers to execute arbitrary PHP code via a URL in the editorinserttop parameter. NOTE: the editorinsertbottom vector is already covered by CVE-2006-6042...

phpwebthings-rfi.txt

script:phpWebThings ==1.5.2 RFI dir url:http://sourceforge.net/project/showfiles.php?groupid=19103 author:titanichacker c0ntact:[email protected] H.P: hack-teach.com & mohandko.com & tryag.com bug in: /core/editor.php include$editorinserttop; include$editorinsertbottom; exploit:...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Dokeos 1.8.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the img parameter to main/inc/lib/fckeditor/editor/plugins/ImageManager/editor.php and other unspecified vectors...

CVE-2007-2901

Multiple cross-site scripting XSS vulnerabilities in Dokeos 1.8.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the img parameter to main/inc/lib/fckeditor/editor/plugins/ImageManager/editor.php and other unspecified vectors...

CVE-2007-2901: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Dokeos 1.8.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the img parameter to main/inc/lib/fckeditor/editor/plugins/ImageManager/editor.php and other unspecified vectors...