CVE-2006-2463

viewalbum.php in SelectaPix 1.31 and earlier allows remote attackers to obtain the installation path via a certain request, which displays the path in an error message, possibly due to an invalid or missing parameter...

Design/Logic Flaw

viewalbum.php in SelectaPix 1.31 and earlier allows remote attackers to obtain the installation path via a certain request, which displays the path in an error message, possibly due to an invalid or missing parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in the validation feature in Macromedia ColdFusion 5 and earlier allows remote attackers to inject arbitrary web script or HTML via a "required" field when the associated normal field is missing or empty, which is not sanitized before being presented in an...

CVE-2006-2364

CVE-2006-2364 is an XSS vulnerability affecting Macromedia ColdFusion 5 and earlier. The issue arises in the validation feature: if a related normal field is missing or empty, the _required field is not sanitized before being rendered in an error message, allowing remote script/HTML injection. Th...

Design/Logic Flaw

RT: Request Tracker 3.5.HEAD allows remote attackers to obtain sensitive information via the Rows parameter in Dist/Display.html, which reveals the installation path in an error message...

Design/Logic Flaw

zenphoto 1.0.1 beta and earlier allow remote attackers to obtain sensitive information via a direct request for the 1 /photos/themes/default/ and 2 /photos/themes/testing/ URIs, which reveals the path in an error message...

CVE-2006-2169

RT: Request Tracker 3.5.HEAD allows remote attackers to obtain sensitive information via the Rows parameter in Dist/Display.html, which reveals the installation path in an error message...

CVE-2006-2169

CVE-2006-2169 affects RT: Request Tracker 3.5.HEAD. The vulnerability is described as a leak of the installation path via the Rows parameter in Dist/Display.html, exposed in an error message. The provided documents confirm the affected software and the underlying cause (exposed path information) ...

CVE-2006-2091

admin.php in Virtual War VWar 1.5 and versions before 1.2 allows remote attackers to obtain sensitive information via an invalid vwarroot parameter, which reveals the path in an error message...

Design/Logic Flaw

admin.php in Virtual War VWar 1.5 and versions before 1.2 allows remote attackers to obtain sensitive information via an invalid vwarroot parameter, which reveals the path in an error message...

Design/Logic Flaw

plug.php in Land Down Under LDU 802 and earlier allows remote attackers to obtain sensitive information via an invalid 1 month or 2 year parameter, which reveals the path in an error message...

CVE-2006-2096

plug.php in Land Down Under LDU 802 and earlier allows remote attackers to obtain sensitive information via an invalid 1 month or 2 year parameter, which reveals the path in an error message...

Sql injection

SQL injection vulnerability in page.php in SLsite 1.0 allows remote attackers to execute arbitrary SQL commands via the idpage parameter. NOTE: this issue could be used to produce resultant XSS from an error message...

Design/Logic Flaw

Scry Gallery 1.1 allows remote attackers to obtain sensitive information via an invalid p parameter, which reveals the path in an error message...

CVE-2006-2013

SQL injection vulnerability in page.php in SLsite 1.0 allows remote attackers to execute arbitrary SQL commands via the idpage parameter. NOTE: this issue could be used to produce resultant XSS from an error message...

CVE-2006-2013

SQL injection vulnerability in page.php in SLsite 1.0 allows remote attackers to execute arbitrary SQL commands via the idpage parameter. NOTE: this issue could be used to produce resultant XSS from an error message...

Design/Logic Flaw

The comrss option rss.php in 1 Mambo and 2 Joomla! allows remote attackers to obtain sensitive information via an invalid feed parameter, which reveals the path in an error message...

CVE-2006-1956

The comrss option rss.php in 1 Mambo and 2 Joomla! allows remote attackers to obtain sensitive information via an invalid feed parameter, which reveals the path in an error message...

Design/Logic Flaw

index.php in Lifetype 1.0.3 allows remote attackers to obtain sensitive information via an invalid show parameter, which reveals the path in an error message...

Directory traversal

Directory traversal vulnerability in FarsiNews 2.5.3 Pro and earlier allows remote attackers to obtain the installation path via ".." sequences in the archive parameter to index.php, which leaks the full pathname in an error message...