CVE-2006-0471

Cross-site scripting XSS vulnerability in the bbcode function in functions.php in my little homepage my little forum, as last modified in June 2005, allows remote attackers to inject arbitrary Javascript via a javascript URI in BBcode link tags...

CVE-2006-0471

CVE-2006-0471 describes a cross-site scripting (XSS) vulnerability in the bbcode function of functions.php in the My Little homepage / My Little Forum package (last modified June 2005). The flaw allows remote attackers to inject arbitrary JavaScript via a javascript: URI used in BBcode link tags,...

CVE-2006-0471

Cross-site scripting XSS vulnerability in the bbcode function in functions.php in my little homepage my little forum, as last modified in June 2005, allows remote attackers to inject arbitrary Javascript via a javascript URI in BBcode link tags...

Cross site scripting

Cross-site scripting XSS vulnerability in SaralBlog 1.0 allows remote attackers to inject arbitrary web script or HTML via a website field in a new comment to view.php, which is not properly handled in the comment function in functions.php...

CVE-2006-0346

Cross-site scripting XSS vulnerability in SaralBlog 1.0 allows remote attackers to inject arbitrary web script or HTML via a website field in a new comment to view.php, which is not properly handled in the comment function in functions.php...

[eVuln] microBlog BBCode XSS Vulnerability

New eVuln Advisory: microBlog BBCode XSS Vulnerability http://evuln.com/vulns/36/summary/bt/ --------------------Summary---------------- Software: microBlog Sowtware's Web Site: http://www.stamcar.com/projekti/microblog/ Versions: 2.0 RC-10 Critical Level: Harmless Type: Cross-Site Scripting Clas...

CVE-2006-0233

Cross-site scripting XSS vulnerability in functions.php in microBlog 2.0 RC-10 allows remote attackers to inject arbitrary web script and HTML via a javascript: URI in a url BBcode tag...

Sql injection

SQL injection vulnerability in 1 functions.php, 2 functionsupdate.php, and 3 functionsdisplay.php in VEGO Web Forum 1.26 and earlier allows remote attackers to execute arbitrary SQL commands via the themeid parameter in index.php...

CVE-2006-0065

CVE-2006-0065 describes an SQL injection vulnerability in VEGO Web Forum versions up to and including 1.26, affecting (1) functions.php, (2) functions_update.php, and (3) functions_display.php. The flaw allows remote attackers to execute arbitrary SQL commands via the theme_id parameter in index....

CVE-2005-4037

SQL injection vulnerability in functions.php in Web4Future Affiliate Manager PRO 4.1 and earlier allows remote attackers to execute arbitrary SQL commands via the pid parameter...

CVE-2005-4037

CVE-2005-4037 affects Web4Future Affiliate Manager PRO 4.1 and earlier. The vulnerability is a SQL injection in functions.php reachable via the pid parameter, enabling remote SQL commands. CVSS metrics in the initial entry indicate base score 7.5 (HIGH) with network attack vector and low attack c...

MailWatch authenticate() Function SQL Injection

The remote host appears to be running MailWatch, a web-based frontend to MailScanner written in PHP. The version of MailWatch installed on the remote host fails to sanitize the username and password before using them in database queries in the 'authenticate' function of 'functions.php'. This issu...

Land Down Under <= 800 Multiple Vulnerabilities

The remote version of Land Down Under is prone to various SQL injection and cross-site scripting attacks provided PHP's 'magicquotes' setting is disabled due to its failure to sanitize the request URI before using it in 'system/functions.php' in the function 'ldulog'. A malicious user may be able...

CVE-2004-2038

CVE-2004-2038 concerns a cross-site scripting (XSS) vulnerability in Land Down Under (LDU) prior to version 700. The issue allows remote attackers to inject arbitrary web script or HTML via a BBCode img tag in one of three PHP files: functions.php , header.php , or auth.inc.php . The provided doc...

CVE-2004-2038

Cross-site scripting XSS vulnerability in Land Down Under LDU before LDU 700 allows remote attackers to inject arbitrary web script or HTML via a BBcode img tag in 1 functions.php, 2 header.php or 3 auth.inc.php...

CVE-2004-2038

Cross-site scripting XSS vulnerability in Land Down Under LDU before LDU 700 allows remote attackers to inject arbitrary web script or HTML via a BBcode img tag in 1 functions.php, 2 header.php or 3 auth.inc.php...

CVE-2004-0327

CVE-2004-0327 affects PhpNewsManager 1.46. A directory traversal vulnerability exists in functions.php, allowing remote attackers to retrieve arbitrary files via .. sequences in the clang parameter. The provided documents confirm the vulnerable component and the exploitation vector but do not inc...

CVE-2004-0030

CVE-2004-0030 describes a PHP remote file inclusion in PHPGEDVIEW 2.61 via PGV_BASE_DIRECTORY in functions.php, authentication_index.php, and config_gedcom.php, enabling remote code execution by referencing a URL on a remote server. Root cause: unsafely using a user-controllable base directory pa...

PT-2004-1245 · Php · Phpgedview

Name of the Vulnerable Software and Affected Versions: PHPGEDVIEW version 2.61 Description: The issue allows remote attackers to execute arbitrary PHP code by modifying the PGV BASE DIRECTORY parameter to reference a URL on a remote web server that contains the code. This is possible due to a...

PT-2003-2445 · Cpcommerce · Cpcommerce

Name of the Vulnerable Software and Affected Versions: cpCommerce version 0.5f Description: The issue allows remote attackers to execute arbitrary code via the prefix parameter in the functions.php file. This is a result of a remote file inclusion vulnerability. Recommendations: For cpCommerce...