44 matches found
Sql injection
Multiple SQL injection vulnerabilities in phpx 3.5.15 allow remote attackers to execute arbitrary SQL commands via the 1 imageid or 2 catid parameter to a gallery.php; the 3 newsid parameter to b news.php or c print.php; 4 the newscatid parameter to news.php; the 5 catid, 6 topicid, or 7 postid...
CVE-2007-1550
Multiple SQL injection vulnerabilities in phpx 3.5.15 allow remote attackers to execute arbitrary SQL commands via the 1 imageid or 2 catid parameter to a gallery.php; the 3 newsid parameter to b news.php or c print.php; 4 the newscatid parameter to news.php; the 5 catid, 6 topicid, or 7 postid...
CVE-2007-1550: Undefined Security Weakness
Multiple SQL injection vulnerabilities in phpx 3.5.15 allow remote attackers to execute arbitrary SQL commands via the 1 imageid or 2 catid parameter to a gallery.php; the 3 newsid parameter to b news.php or c print.php; 4 the newscatid parameter to news.php; the 5 catid, 6 topicid, or 7 postid...
PHPX 3.5.153.5.16 - forums.php SQL Injection
PHPX 3.5.153.5.16 - forums.php SQL Injection source: https://www.securityfocus.com/bid/23033/info PHPX is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input. Exploiting these issues could allow an attacker to steal cookie-base...
CVE-2006-1288
Multiple SQL injection vulnerabilities in Invision Power Board IPB 2.0.4 and 2.1.4 before 20060105 allow remote attackers to execute arbitrary SQL commands via cookies, related to 1 arrays of id/stamp pairs and 2 the keys in arrays of key/value pairs in ipsclass.php; 3 the topics variable in...
Sql injection
Multiple SQL injection vulnerabilities in Invision Power Board IPB 2.0.4 and 2.1.4 before 20060105 allow remote attackers to execute arbitrary SQL commands via cookies, related to 1 arrays of id/stamp pairs and 2 the keys in arrays of key/value pairs in ipsclass.php; 3 the topics variable in...
CVE-2006-1288
Multiple SQL injection vulnerabilities in Invision Power Board IPB 2.0.4 and 2.1.4 before 20060105 allow remote attackers to execute arbitrary SQL commands via cookies, related to 1 arrays of id/stamp pairs and 2 the keys in arrays of key/value pairs in ipsclass.php; 3 the topics variable in...
CVE-2006-1120: Undefined Security Weakness
Multiple cross-site scripting XSS vulnerabilities in DCP-Portal 6.1.1 and earlier, with registerglobals enabled, allow remote attackers to inject arbitrary web script or HTML via the 1 itsurl parameter in the documents page and 2 url parameter in the sendwrite page of a index.php; 3 subject, and ...
DCP Portal: Multiple XSS Vulnerabilities
=========================================================== DCP Portal: Multiple XSS Vulnerabilities =========================================================== Technical University of Vienna Security Advisory TUVSA-0603-001, March 9, 2006 =========================================================...
CVE-2005-3365
Multiple SQL injection vulnerabilities in DCP-Portal 6 and earlier allow remote attackers to execute arbitrary SQL commands, possibly requiring encoded characters, via 1 the name parameter in register.php, 2 the email parameter in lostpassword.php, 3 the year parameter in calendar.php, and the 4...
CVE-2005-2989: Undefined Security Weakness
Multiple SQL injection vulnerabilities in DeluxeBB 1.0 and 1.0.5 allow remote attackers to execute arbitrary SQL commands via the 1 tid parameter to topic.php, the uid parameter to 2 misc.php or 3 pm.php, or the fid parameter to 3 forums.php or 4 newpost.php...
DeluxeBB 1.0 - 'forums.php' SQL Injection
source: https://www.securityfocus.com/bid/14851/info DeluxeBB is prone to multiple SQL injection vulnerabilities. These are due to a lack of proper sanitization of user-supplied input before being sent to SQL queries. Successful exploitation could result in a compromise of the application,...
Land Down Under <= 800 Multiple Vulnerabilities
The remote version of Land Down Under is prone to various SQL injection and cross-site scripting attacks provided PHP's 'magicquotes' setting is disabled due to its failure to sanitize the request URI before using it in 'system/functions.php' in the function 'ldulog'. A malicious user may be able...
CVE-2005-2675: Undefined Security Weakness
Note: the vendor has disputed this issue. Multiple SQL injection vulnerabilities in Land Down Under LDU 800 allow remote attackers to execute arbitrary SQL commands via the 1 s or 2 m parameter to forums.php, 3 o, 4 w, 5 s, or 6 p parameter to list.php, 7 m parameter to journal.php, 8 x or 9 n...
Land Down Under 800801 - forums.php Multiple SQL Injections
Land Down Under 800801 - forums.php Multiple SQL Injections source: https://www.securityfocus.com/bid/14618/info Land Down Under is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in SQL queries. Successful...
CVE-2005-2570
FunkBoard 0.66CF, and possibly earlier versions, allows remote attackers to obtain sensitive information via a direct request to forums.php, which reveals the path in an error message...
CVE-2005-2570
CVE-2005-2570 affects FunkBoard 0.66CF and possibly earlier releases. A direct request to forums.php can disclose sensitive information by revealing the path in an error message, enabling information disclosure. The available sources state the flaw but do not provide detailed exploit scenarios, a...
CVE-2005-2570
FunkBoard 0.66CF, and possibly earlier versions, allows remote attackers to obtain sensitive information via a direct request to forums.php, which reveals the path in an error message...
CVE-2004-2362: Undefined Security Weakness
PHPX 3.2.6 and earlier allows remote attackers to obtain the physical path of PHPX via a null or invalid value in the limit parameter, which leaks the pathname in a database error message, as demonstrated using forums.php...
CVE-2005-2570: Undefined Security Weakness
FunkBoard 0.66CF, and possibly earlier versions, allows remote attackers to obtain sensitive information via a direct request to forums.php, which reveals the path in an error message...