PHPXplorer 0.9.33 - 'action.php' Directory Traversal

source: https://www.securityfocus.com/bid/16292/info phpXplorer is prone to a directory traversal vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable...

PHPCOIN 1.2.2 - '/includes/db.php?$_CCFG[_PKG_PATH_DBSE]' Traversal Arbitrary File Access

source: https://www.securityfocus.com/bid/15831/info PhpCOIN is prone to a file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit this issue to include arbitrary remote PHP code and execute it in the context ...

EncapsGallery 1.0 - 'gallery.php' SQL Injection

source: https://www.securityfocus.com/bid/15836/info EncapsGallery is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation could result in a compromise of the...

vBulletin 1.0.1 lite2.x3.0 - admincpuser.php Multiple SQL Injections

vBulletin 1.0.1 lite2.x3.0 - admincpuser.php Multiple SQL Injections source: https://www.securityfocus.com/bid/14872/info vBulletin is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in...

PHPMyFAQ 1.5.1 - Local File Inclusion

source: https://www.securityfocus.com/bid/14929/info PHPMyFAQ is prone to a local file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary server-side script code that resides o...

VBZoom Forum 1.11 - 'show.php' SQL Injection

source: https://www.securityfocus.com/bid/14383/info VBZooM Forum is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation could result in a compromise of the...

DUware DUamazon Pro 3.03.1 - review.asp?iPro SQL Injection

DUware DUamazon Pro 3.03.1 - review.asp?iPro SQL Injection source: https://www.securityfocus.com/bid/14033/info DUamazon Pro is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL...

Loki Download Manager 2.0 - 'Catinfo.asp' SQL Injection

source: https://www.securityfocus.com/bid/13900/info Loki Download Manager is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input to the 'catinfo.asp' script before using it in an SQL query. Successful exploitation...

JiRo's Upload System 1.0 - 'login.asp' SQL Injection

source: https://www.securityfocus.com/bid/13833/info JiRo's Upload System is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation could result in a compromise of...

NEXTWEB (i)Site - 'login.asp' SQL Injection

source: https://www.securityfocus.com/bid/13834/info NEXTWEB iSite is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation could result in a compromise of the...

DirectTopics 2 - 'topic.php' SQL Injection

source: https://www.securityfocus.com/bid/13608/info DirectTopics is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation could result in a compromise of the...

CartWIZ 1.10 - AddToCart.asp SQL Injection

CartWIZ 1.10 - AddToCart.asp SQL Injection source: https://www.securityfocus.com/bid/13330/info CartWIZ is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input prior to utilizing the data in an SQL query. Successful...

ProfitCode Software PayProCart 3.0 - AdminShop ProMod Cross-Site Scripting

ProfitCode Software PayProCart 3.0 - AdminShop ProMod Cross-Site Scripting source: https://www.securityfocus.com/bid/13308/info PayProCart is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may...

DUportal Pro 3.4 - 'search.asp?iChannel' SQL Injection

source: https://www.securityfocus.com/bid/13285/info DUportal Pro is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in SQL queries. A successful exploit could allow an attacker to compromise the application,...

InterAKT Online MX Shop 1.1.1 - SQL Injection

InterAKT Online MX Shop 1.1.1 - SQL Injection source: https://www.securityfocus.com/bid/12957/info MX Shop is reportedly affected by an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. This...

e107 Website System 0.5/0.6 - 'Log.php' HTML Injection

source: https://www.securityfocus.com/bid/10395/info It is reported that e107 website system is prone to a remote HTML injection vulnerability. This issue is due to a failure by the application to properly sanitize user-supplied input. The problem presents itself when a user supplies malicious HT...

DSA-420 jitterbug - improperly sanitised input

Bulletin has no description...

Lil'HTTP Pbcgi.cgi XSS Vulnerability

Recently, I reported on a vulnerability in the Urlcount.cgi script of Lil'HTTP Server Summit Computer Networks. This time, another CGI pbcgi.cgi has been found vulnerable to cross-site scripting. Some versions of this CGI will take the form input you POST/GET to it, and break it into name/e-mail...