CVE-2006-3196

index.php in singapore 0.10.0 and earlier allows remote attackers to obtain the installation path via an invalid template parameter, which reveals the path in an error message...

CVE-2006-3183

Cross-site scripting XSS vulnerability in index.php in MobeScripts Mobile Space Community 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the 1 browse parameter, which is not filtered in the resulting error message, and multiple unspecified input fields, includi...

CVE-2006-3159

pipemaster in Sun ONE/iPlanet Messaging Server 5.2 HotFix 1.16 built May 14 2003 allows local users to read portions of restricted files via a symlink attack on msg.conf in a directory identified by the CONFIGROOT environment variable, which returns the first line of the file in an error message...

CVE-2006-3034

MyScrapbook 3.1 allows remote attackers to obtain sensitive information via a direct request to files in the txt-db-api directory such as txt-db-api/sql.php, which reveals the path in an error message...

Design/Logic Flaw

videoPage.php in L0j1k tinyMuw 0.1.0 allows remote attackers to obtain sensitive information via a certain id parameter, probably with an invalid value, which reveals the path in an error message...

Design/Logic Flaw

Net Portal Dynamic System NPDS 5.10 and earlier allows remote attackers to obtain sensitive information via a direct request to 1 header.php, 2 contact.php, or 3 forumextender.php, which reveals the path in an error message...

CVE-2006-2970

videoPage.php in L0j1k tinyMuw 0.1.0 allows remote attackers to obtain sensitive information via a certain id parameter, probably with an invalid value, which reveals the path in an error message...

CVE-2006-2950

Net Portal Dynamic System NPDS 5.10 and earlier allows remote attackers to obtain sensitive information via a direct request to 1 header.php, 2 contact.php, or 3 forumextender.php, which reveals the path in an error message...

MobeSpace v2.0 - XSS

MobeSpace v2.0 Homepage: http://mobescripts.com/ Effected files: index.php The input forms of: - Profile - Comments - Uploading a file to your locker - Posting in your blog - Creating a caption for your pic - Sending PM's The input boxes of the above do not sanatize user input before generating i...

Information disclosure

Partial Links 1.2.2 allows remote attackers to obtain sensitive information via a direct request to 1 pagefooter.php and 2 pageheader.php, which displays the path in an error message...

Design/Logic Flaw

view.php in KnowledgeTree Open Source 3.0.3 and earlier allows remote attackers to obtain the full installation path via a crafted fDocumentId parameter, which displays the path in the resulting error message. NOTE: this might be resultant from another vulnerability, since this vector also produc...

Cross site scripting

Cross-site scripting XSS vulnerability in gallery.php in Captivate 1.0 allows remote attackers to inject arbitrary web script or HTML via the page parameter, which is reflected in an error message...

CVE-2006-2796

Cross-site scripting XSS vulnerability in gallery.php in Captivate 1.0 allows remote attackers to inject arbitrary web script or HTML via the page parameter, which is reflected in an error message...

CVE-2006-2796

Cross-site scripting XSS vulnerability in gallery.php in Captivate 1.0 allows remote attackers to inject arbitrary web script or HTML via the page parameter, which is reflected in an error message...

CVE-2006-2796

CVE-2006-2796 describes a reflected cross-site scripting (XSS) vulnerability in the gallery.php component of Captivate 1.0, where the page parameter is reflected in an error message and can be exploited by remote attackers to inject arbitrary HTML/Script. Affected software is Captivate 1.0 (galle...

CVE-2006-2643

Cross-site scripting XSS vulnerability in index.php in Monster Top List MTL 1.4 allows remote attackers to inject arbitrary web script or HTML via the usererrormessage parameter...

XSS in Monster Top List | MTL 1.4

XSS in Monster Top List | MTL 1.4 --------------------------------- Software : Monster Top List --------------------------------- version : Monster Top List 1.4 --------------------------------- Exploit : www.site.com/index.phpusererrormessage=XSS-CODE --------------------------------- Discovery ...

Sql injection

Jemscripts DownloadControl 1.0 allows remote attackers to obtain sensitive information via an invalid dcid parameter to dc.php, which leaks the pathname in an error message. NOTE: this was originally claimed to be SQL injection, but it is probably resultant from another issue in functions.php...

CVE-2006-2535

index.php in Destiney Links Script 2.1.2 allows remote attackers to obtain the installation path via an invalid show parameter referencing a non-existent file, which reveals the path in the resulting error message. NOTE: this issue might be resultant from a more serious issue such as directory...

Directory traversal

index.php in Destiney Links Script 2.1.2 allows remote attackers to obtain the installation path via an invalid show parameter referencing a non-existent file, which reveals the path in the resulting error message. NOTE: this issue might be resultant from a more serious issue such as directory...