CVE-2007-5150: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the isgod function in includes/nukesentinel.php in NukeSentinel 2.5.11 allows remote attackers to execute arbitrary SQL commands via base64-encoded data in an admin cookie, a different vector than CVE-2007-5125...

CVE-2007-5163: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in includes/functions/layout.php in Nexty 1.01.A Beta allows remote attackers to execute arbitrary PHP code via a URL in the rel parameter. NOTE: this issue is disputed by CVE because the applicable include is in a function that is not called on a direct...

CVE-2007-5140: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in includes/archive/archivetopic.php in IntegraMOD Nederland 1.4.2 allows remote attackers to execute arbitrary PHP code via a URL in the phpbbrootpath parameter...

CVE-2007-5129: Exposure of Sensitive Information to an Unauthorized Actor

SimpGB 1.46.02 stores sensitive information under the web root with insufficient access control, which allows remote attackers to 1 obtain sensitive configuration information via a direct request for admin/cfginfo.php; and 2 download arbitrary .inc files via a direct request, as demonstrated by...

CVE-2007-4873: Undefined Security Weakness

SimpNews 2.41.03 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download arbitrary .inc files via a direct request, as demonstrated by admin/includes/dbtables.inc...

FrontAccounting 1.13 Remote File Inclusion Vulnerabilities

Exploit for unknown platform in category web applications ========================================================== FrontAccounting 1.13 Remote File Inclusion Vulnerabilities ========================================================== ?????????? ??????????????? ???????????????????...

CVE-2007-5015: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Streamline PHP Media Server 1.0-beta4 allow remote attackers to execute arbitrary PHP code via a URL in the slthemeunixpath parameter to 1 adminfooter.php, 2 infofooter.php, 3 themefooter.php, 4 browsefooter.php, 5 accountfooter.php, or 6...

CVE-2007-4458: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in includes/class/classtpl.php in Firesoft allows remote attackers to execute arbitrary PHP code via a URL in the cachefile parameter...

CVE-2007-4185: Undefined Security Weakness

Joomla! 1.0.12 allows remote attackers to obtain sensitive information via a direct request for 1 Stat.php 2 OutputFilter.php, 3 OutputCache.php, 4 Modifier.php, 5 Reader.php, and 6 TemplateCache.php in includes/patTemplate/patTemplate/; 7 includes/Cache/Lite/Output.php; and other unspecified...

FrontAccounting 1.12 Build 31 Remote File Inclusion Vulnerability

Exploit for unknown platform in category web applications ================================================================= FrontAccounting 1.12 Build 31 Remote File Inclusion Vulnerability ================================================================= ?????????? ???????????????...

FrontAccounting 1.12 build 31 - Remote File Inclusion

FrontAccounting 1.12 build 31 - Remote File Inclusion ?????????? ??????????????? ??????????????????? ??????????????????????? ?????????????????????????? ?????????????????????????????? ????????????????????????????????? ??????????????????????????????????? ?????????????????????????????????????...

FrontAccounting 1.12 build 31 - Remote File Inclusion

?????????? ??????????????? ??????????????????? ??????????????????????? ?????????????????????????? ?????????????????????????????? ????????????????????????????????? ??????????????????????????????????? ????????????????????????????????????? ???????????????????????????????????????...

CVE-2007-4139: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Temporary Uploads editing functionality wp-admin/includes/upload.php in WordPress 2.2.1, allows remote attackers to inject arbitrary web script or HTML via the style parameter to wp-admin/upload.php...

CVE-2007-4118: Undefined Security Weakness

PHP remote file inclusion vulnerability in includes/functions.inc.php in phpVoter 0.6 allows remote attackers to execute arbitrary PHP code via a URL in the sitepath parameter...

joomla-sql.txt

Hello Joomla multiple vulerabilities Discovered By : HACKERS PAL Copy rights : HACKERS PAL Website : http://www.soqor.net Email Address : [email protected] Affected Versions 1.0.X - tested on 1.0.12 and 1.5 maybe affected - not tested but probebly affected sql injection...

CVE-2007-3808: Undefined Security Weakness

SQL injection vulnerability in includes/search.php in paFileDB 3.6 allows remote attackers to execute arbitrary SQL commands via the categories parameter in a search action to index.php, a different vector than CVE-2005-2000...

paFileDB 3.6 - 'search.php' SQL Injection

Site: http://www.phparena.net/pafiledb Description: SQL injection categories in includes/search.php Code: $results = $db-GetArray"SELECT FROM ".$dbPrefix."files WHERE ".$searchin." AND filecatid IN ".implode',',$POST'categories'.""; Comment:"ouuch" SQL: UNION SELECT ALL...

CVE-2007-3639

WordPress before 2.2.2 allows remote attackers to redirect visitors to other websites and potentially obtain sensitive information via 1 the wphttpreferer parameter to wp-pass.php, related to the wpgetreferer function in wp-includes/functions.php; and possibly other vectors related to 2...

CVE-2007-3575: Undefined Security Weakness

SQL injection vulnerability in includes/functions in FreeDomain.co.nr Clone allows remote attackers to execute arbitrary SQL commands via the logindomain parameter to members.php...

CVE-2007-3563: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in includes/viewpage.php in AV Arcade 2.1b allows remote attackers to execute arbitrary SQL commands via the id parameter in a viewpage action to index.php...