Cross site scripting

Cross-site scripting XSS vulnerability in hlstats.php in HLstats 1.35, and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via 1 the PATHINFO or 2 the action parameter...

CVE-2007-2812

CVE-2007-2812 affects HLstats HLstats 1.35 (and possibly earlier) with a cross-site scripting (XSS) flaw in hlstats.php that allows an attacker to inject arbitrary scripts via PATH_INFO or the action parameter. The connected documents confirm the vulnerability vectors but do not provide patch det...

hlstats-xss.txt

HLstats v1.35 Cross-Site Scripting Vulnerability HLstats contains a cross-site scripting vulnerability that may be exploited through the URI. Vulnerability: http://target.com/hlstats/hlstats.php/"alert1 Vulnerable: HLstats v1.35 other versions may also be vulnerable Google d0rk: "generated in...

hlstarts-xss2.txt

HLstats v1.35 - Cross-Site Scripting Vulnerability 2 HLstats v1.35 - Cross-Site Scripting Vulnerability 2 discovered by John Martinelli of RedLevel Security Google d0rk: "generated in real-time by HLstats" file hlstats.php - variable action - method get alert1"...

RedLevel Advisory #016 - HLstats v1.35 Cross-Site Scripting Vulnerability

HLstats v1.35 Cross-Site Scripting Vulnerability HLstats contains a cross-site scripting vulnerability that may be exploited through the URI. Vulnerability: http://target.com/hlstats/hlstats.php/"scriptalert1/script Vulnerable: HLstats v1.35 other versions may also be vulnerable Google d0rk:...

RedLevel Advisory #017 - HLstats v1.35 Cross-Site Scripting Vulnerability #2

!-- HLstats v1.35 - Cross-Site Scripting Vulnerability 2 Vulnerable Variable: action Vulnerable File: hlstats.php Vulnerable: HLstats 1.2 other versions may also be vulnerable Google d0rk: "generated in real-time by HLstats" John Martinelli [email protected] RedLevel Security...

HLstats 1.35 - 'hlstats.php' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/24063/info HLstats is prone to mulitiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied data. Exploiting these issues may help an attacker steal cookie-based authentication credentials and launch...

HLstats 1.35 - hlstats.php Multiple Cross-Site Scripting Vulnerabilities

HLstats 1.35 - hlstats.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/24063/info HLstats is prone to mulitiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied data. Exploiting these issues may...

CVE-2007-0840

Cross-site scripting XSS vulnerability in HLstats before 1.35 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in the search class. NOTE: it is possible that this issue overlaps CVE-2006-4543.3 or CVE-2006-4454...

Cross site scripting

Cross-site scripting XSS vulnerability in HLstats before 1.35 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in the search class. NOTE: it is possible that this issue overlaps CVE-2006-4543.3 or CVE-2006-4454...

CVE-2007-0840

CVE-2007-0840 is an XSS flaw in HLstats (HLstats.php) affecting HLstats up to version 1.35. Connected records specify vulnerable parameters: (1) authusername and (2) authpassword in HLstats.php, enabling remote attackers to inject arbitrary web script or HTML. The issue is tied to HLstats’ search...

CVE-2007-0840

Cross-site scripting XSS vulnerability in HLstats before 1.35 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in the search class. NOTE: it is possible that this issue overlaps CVE-2006-4543.3 or CVE-2006-4454...

CVE-2006-6780

SQL injection vulnerability in the login form in HLstats 1.20 through 1.34 allows remote attackers to execute arbitrary SQL commands via the killLimit parameter...

CVE-2006-6781

HLstats 1.20 through 1.34 allows remote attackers to obtain sensitive information via playinfo mode, with certain values of the player and playerdatalastName parameters, which reveals the path in an error message...

CVE-2006-6781

HLstats 1.20 through 1.34 allows remote attackers to obtain sensitive information via playinfo mode, with certain values of the player and playerdatalastName parameters, which reveals the path in an error message...

CVE-2006-6780

CVE-2006-6780 describes an SQL injection in HLstats (versions 1.20–1.34) login form, exploitable via the killLimit parameter to execute arbitrary SQL commands. The issue arises from unsafely handling user input in the login process, leading to potential compromise of data confidentiality/integrit...

CVE-2006-6780

SQL injection vulnerability in the login form in HLstats 1.20 through 1.34 allows remote attackers to execute arbitrary SQL commands via the killLimit parameter...

CVE-2006-6781

CVE-2006-6781 affects HLstats 1.20 through 1.34. The vulnerability allows remote attackers to obtain sensitive information via playinfo mode, when certain values of player and playerdata[lastName][] parameters are used, causing an error message to reveal the file path. Connected documents confirm...

hlstats-sql.txt

Hlstats is more than 5 years old. HLstats has been downloaded more than 270,000 from http://sf.net. Nothing more than absolutely benign XSS has been reported for this application, until NOW. Merry Christmass, --Michael Brooks Homepage: http://sourceforge.net/projects/hlstats/ -----BEGIN PGP SIGNE...

HLStats <=1.34 (hlstats.php) Remote SQL Injection Exploit

No description provided by source. brb ?php / Live Exploit Code SQL Inection + Path Disclosure Affects HLStats HLStats =1.34 and Hlstats = 1.20 works with magicquotesgpc=On by Michael Brooks / print "titleHLStats SQL Injection Exploit/title body bgcolor='009900' font color='FF0000'...