CVE-2008-2072: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in Virtual Design Studio vlbook 1.21 allows remote attackers to inject arbitrary web script or HTML via the l parameter, a different vector than CVE-2006-3260...

CVE-2008-2082: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in Siteman 2.0.x2 allows remote attackers to inject arbitrary web script or HTML via the module parameter, which leaks the path in an error message...

CVE-2008-2081: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in Siteman 2.0.x2 allows remote authenticated administrators to include and execute arbitrary local files via a .. dot dot in the module parameter...

SmartBlog 1.3 - index.php SQL Injection

SmartBlog 1.3 - index.php SQL Injection Smartblog remote SQL injection exploit Script download : http://ftp1.toocharger.com/scfQ9NS/smartblog3868.zip Founder: His0k4 ALGERIAN HACKER Greetz : All friends & muslims HaCkErS... Contact: His0k4.hlmatgmail.com Dork : Actionnée par smartblog P.O.C :...

zencart-sql.txt

+==========================================================================+ + 2008 Zen Cart & SQL-Injection Vulnerabilities + +==========================================================================+ Authors: Ivan Sanchez Product: Zen Cart Web: http://www.zen-cart.com/ Versions: 2008 Zen Cart...

CVE-2008-2046

CVE-2008-2046 describes a cross-site scripting (XSS) vulnerability in the Softpedia SiteXS CMS 0.1.1 Pre-Alpha. The issue resides in index.php and allows remote attackers to inject arbitrary web script or HTML via the user parameter. Documented impact is partial integrity exposure with no confide...

CVE-2008-2046: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in Softpedia SiteXS CMS 0.1.1 Pre-Alpha allows remote attackers to inject arbitrary web script or HTML via the user parameter...

CVE-2008-2036

CVE-2008-2036 is a SQL injection vulnerability in dream4 Koobi Pro 6.25, affecting index.php via the poll_id parameter in a poll action. The root cause is unvalidated input leading to arbitrary SQL execution by remote attackers. Exploitation details or in-the-wild status are not provided in the c...

CVE-2008-2036

SQL injection vulnerability in index.php in dream4 Koobi Pro 6.25 allows remote attackers to execute arbitrary SQL commands via the pollid parameter in a poll action...

CVE-2008-2024

CVE-2008-2024 describes a cross-site scripting (XSS) vulnerability in the PHP script index.php of miniBB 2.2 (and possibly earlier) that can be triggered when register_globals is enabled. The issue allows remote attackers to inject arbitrary scripts or HTML via the glang[] parameter in a register...

Sql injection

SQL injection vulnerability in index.php in the PostSchedule 1.0 module for PostNuke allows remote attackers to execute arbitrary SQL commands via the eid parameter in an event action...

CVE-2008-2036: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in dream4 Koobi Pro 6.25 allows remote attackers to execute arbitrary SQL commands via the pollid parameter in a poll action...

CVE-2008-2012: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in the PostSchedule 1.0 module for PostNuke allows remote attackers to execute arbitrary SQL commands via the eid parameter in an event action...

CVE-2008-2028: Exposure of Sensitive Information to an Unauthorized Actor

miniBB 2.2, and possibly earlier, when registerglobals is enabled, allows remote attackers to obtain the full path via a direct request to the glang parameter in a registernew action to index.php, which leaks the path in an error message...

CVE-2008-2024: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in miniBB 2.2, and possibly earlier, when registerglobals is enabled, allows remote attackers to inject arbitrary web script or HTML via the glang parameter in a registernew action...

CVE-2008-2012

CVE-2008-2012 affects the PostSchedule 1.0 module for PostNuke. A SQL injection in index.php allows remote attackers to modify the database by supplying the eid parameter in an event action. Documented impact: arbitrary SQL execution with a CVSSv2 base score of 7.5 (HIGH). No remediation details ...

Unfixed XSS vulnerability at www.ptc-house.com

Security researcher PaPPy, has submitted on 29/04/2008 a cross-site-scripting XSS vulnerability affecting www.ptc-house.com, which at the time of submission ranked 171866 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 29/04/2008. It is current...

CVE-2008-1983

Cross-site scripting XSS vulnerability in Advanced Electron Forum AEF 1.0.6 allows remote attackers to inject arbitrary web script or HTML via the beg parameter in a members action to index.php...

CVE-2008-1975

CVE-2008-1975 describes an SQL injection vulnerability in the E-RESERV 2.1 web application, exploitable via the ID_loc parameter in index.php. The vulnerability allows remote attackers to execute arbitrary SQL commands, as the input is treated unsafely within database queries. Multiple connected ...

CVE-2008-1975: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in E-RESERV 2.1 allows remote attackers to execute arbitrary SQL commands via the IDloc parameter...