CVE-2007-1343

CVE-2007-1343 concerns WebCalendar, a PHP-based calendar app. The vulnerability arises from WebCalendar’s includes/functions.php not protecting the internal variable noSet from external modification, enabling remote attackers to overwrite variables via a URL-modified noSet parameter, which can le...

WebCalendar includes/functions.php noSet Variable Overwrite

The version of WebCalendar installed on the remote host allows an attacker to overwrite the 'noSet' array used by the application to protect selected global variables. By leveraging this issue, an unauthenticated, remote attacker can gain control of protected global variables, which could lead to...

CVE-2006-7116: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in includes/functions.php in Kubix 0.7 and earlier allows remote attackers to execute arbitrary SQL commands and bypass authentication via the memberid parameter $id variable to index.php...

CVE-2007-1230

Multiple cross-site scripting XSS vulnerabilities in wp-includes/functions.php in WordPress before 2.1.2-alpha allow remote attackers to inject arbitrary web script or HTML via 1 the Referer HTTP header or 2 the URI, a different vulnerability than CVE-2007-1049...

CVE-2007-1230: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in wp-includes/functions.php in WordPress before 2.1.2-alpha allow remote attackers to inject arbitrary web script or HTML via 1 the Referer HTTP header or 2 the URI, a different vulnerability than CVE-2007-1049...

WordPress <= 2.1.1 - Multiple XSS

Because of these vulnerabilities in wp-includes/functions.php, the attackers can inject arbitrary web script or HTML. Solution Update the WordPress to the latest available version at least 2.1.2...

Sql injection

Multiple SQL injection vulnerabilities in Mathis Dirksen-Thedens ZephyrSoft Toolbox Address Book Continued ABC 1.00 allow remote attackers to execute arbitrary SQL commands via the id parameter to the 1 updateRow and 2 deleteRow functions in functions.php. NOTE: some of these details are obtained...

CVE-2007-1122: Undefined Security Weakness

Multiple SQL injection vulnerabilities in Mathis Dirksen-Thedens ZephyrSoft Toolbox Address Book Continued ABC 1.00 and 1.01 allow remote attackers to execute arbitrary SQL commands via the id parameter to the 1 updateRow and 2 deleteRow functions in functions.php, a variant of a SQL injection...

CVE-2007-1121: Undefined Security Weakness

Multiple SQL injection vulnerabilities in Mathis Dirksen-Thedens ZephyrSoft Toolbox Address Book Continued ABC 1.00 allow remote attackers to execute arbitrary SQL commands via the id parameter to the 1 updateRow and 2 deleteRow functions in functions.php. NOTE: some of these details are obtained...

Remote file inclusion

PHP remote file inclusion vulnerability in functions.php in Extreme phpBB aka phpBB Extreme 3.0.1 allows remote attackers to execute arbitrary PHP code via a URL in the phpbbrootpath parameter...

CVE-2007-1105: Undefined Security Weakness

PHP remote file inclusion vulnerability in functions.php in Extreme phpBB aka phpBB Extreme 3.0.1 allows remote attackers to execute arbitrary PHP code via a URL in the phpbbrootpath parameter...

Extreme phpBB 3.0.1 - functions.php Remote File Inclusion

Extreme phpBB 3.0.1 - functions.php Remote File Inclusion C xoron Name: phpBB Extreme 3.0.1 phpbbrootpath Remote File Include Exploit Author: xoron Exploit coded by xoron Download: http://sourceforge.net/project/showfiles.php?groupid=95900 Tesekkurler: pang0, DJR POC:...

Extreme phpBB 3.0.1 (functions.php) Remote File Include Exploit

Exploit for unknown platform in category web applications =============================================================== Extreme phpBB 3.0.1 functions.php Remote File Include Exploit =============================================================== C xoron Name: phpBB Extreme 3.0.1 phpbbrootpath...

CVE-2006-7056: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in DreamCost HostAdmin 3.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the path parameter to 1 functions.php and 2 members.php. NOTE: the index.php vector is covered by CVE-2006-0791...

Cross site scripting

Cross-site scripting XSS vulnerability in the wpexplainnonce function in the nonce AYS functionality wp-includes/functions.php for WordPress 2.0 before 2.0.9 and 2.1 before 2.1.1 allows remote attackers to inject arbitrary web script or HTML via the file parameter to wp-admin/templates.php, and...

CVE-2007-1049: Undefined Security Weakness

Cross-site scripting XSS vulnerability in the wpexplainnonce function in the nonce AYS functionality wp-includes/functions.php for WordPress 2.0 before 2.0.9 and 2.1 before 2.1.1 allows remote attackers to inject arbitrary web script or HTML via the file parameter to wp-admin/templates.php, and...

CVE-2007-0762

PHP remote file inclusion vulnerability in includes/functions.php in phpBB++ Build 100 allows remote attackers to execute arbitrary PHP code via a URL in the phpbbrootpath parameter...

CVE-2007-0762: Undefined Security Weakness

PHP remote file inclusion vulnerability in includes/functions.php in phpBB++ Build 100 allows remote attackers to execute arbitrary PHP code via a URL in the phpbbrootpath parameter...

phpBB++ Build 100 (phpbb_root_path) Remote File Include Exploit

No description provided by source. C xoron Name: phpBB++ phpbbrootpath Remote File Include Exploit Author: xoron Exploit coded by xoron Download: http://sourceforge.net/project/showfiles.php?groupid=86688&packageid=90098 xoron.biz - xoron.info Thanx: str0ke, kacper, k1tk4t, SHiKA, can bjorn...

CVE-2007-0680: Undefined Security Weakness

PHP remote file inclusion vulnerability in includes/functions.php in Phpbb Tweaked 3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbbrootpath parameter...