CVE-2008-1481

The provided sources confirm a Cross-site Scripting (XSS) vulnerability in webSPELL 4.1.2 (component: index.php) exposed via the board parameter. The root cause discussed is lack of input sanitization/validation for that parameter, enabling injection of arbitrary script or HTML. Public references...

joomlad3000-sql.txt

Powered by Download 3000 AUTHOR : S@BUN HOME : http://www.milw0rm.com/author/1334 BLOG : http://my.opera.com/SQL-Injection/blog/ MAiL : [email protected] DORK 1 : "Powered by Download 3000" DORK 2 : allinurl: "comd3000" EXPLOiT :...

CVE-2008-1479: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in cyberfrogs.net cfnetgs 0.24 allows remote attackers to inject arbitrary web script or HTML via the directory parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-1481: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in webSPELL 4.1.2 allows remote attackers to inject arbitrary web script or HTML via the board parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-1464: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Gallarific Free Edition 1.1 allow remote attackers to execute arbitrary SQL commands via the 1 query parameter to a search.php; 2 gusername and 3 gpassword parameters to b login.php; and the 4 username and 5 password parameters to c gadmin/index.php in a...

CVE-2008-1458: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in CS-Cart 1.3.2 allows remote attackers to inject arbitrary web script or HTML via the q parameter in a products search action. NOTE: it was also reported that 1.3.5-SP2 trial edition is also affected...

joomlacinema-sql.txt

Joomla Component comcinema SQL Injection AUTHOR : S@BUN HOME : http://www.milw0rm.com/author/1334 BLOG : http://my.opera.com/SQL-Injection/blog/ MAiL : [email protected] DORK 1 : allinurl: "comcinema" EXPLOiT 1 :...

CVE-2008-1487: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in LinPHA before 1.3.3 allow remote attackers to inject arbitrary web script or HTML via 1 ftp/index.php, 2 viewer.php, 3 functions/other.php, 4 include/leftmenu.class.php, and 5 plugins/stats/statsview.php...

PHP-Nuke Platinum 7.6.b.5 (dynamic_titles.php) SQL Injection Exploit

No description provided by source. !/usr/bin/perl Inphex use LWP::UserAgent; use LWP::Simple; use IO::Socket; use Switch; PHP-Nuke Platinum , ForumsStandart - magicquotesgpc = OFF , SQL Injection nukeusers Structure: userid name username useremail femail userwebsite useravatar userregdate usericq...

PHP-Nuke Platinum 7.6.b.5 (dynamic_titles.php) SQL Injection Exploit

Exploit for unknown platform in category web applications ==================================================================== PHP-Nuke Platinum 7.6.b.5 dynamictitles.php SQL Injection Exploit ==================================================================== !/usr/bin/perl Inphex use...

PHP-Nuke Platinum 7.6.b.5 - dynamic_titles.php SQL Injection

PHP-Nuke Platinum 7.6.b.5 - dynamictitles.php SQL Injection !/usr/bin/perl Inphex use LWP::UserAgent; use LWP::Simple; use IO::Socket; use Switch; PHP-Nuke Platinum , ForumsStandart - magicquotesgpc = OFF , SQL Injection nukeusers Structure: userid name username useremail femail userwebsite...

Sql injection

SQL injection vulnerability in index.php in the Viso Industry Book 2.04 and 2.03 module for eXV2 allows remote attackers to execute arbitrary SQL commands via the kid parameter...

Sql injection

SQL injection vulnerability in index.php in the WebChat 1.60 module for eXV2 allows remote attackers to execute arbitrary SQL commands via the roomid parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in Multiple Time Sheets MTS 5.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the tab parameter to 1 index.php, as demonstrated using mixed case and encoded whitespace characters in the tag; or 2 clientinfo.php, 3 invoices.ph...

Directory traversal

Directory traversal vulnerability in index.php in Multiple Time Sheets MTS 5.0 and earlier allows remote attackers to read arbitrary files via "../..//" modified dot dot sequences in the tab parameter...

CVE-2008-1415

CVE-2008-1415 affects the web app component index.php in Multiple Time Sheets (MTS) 5.0 and earlier. The vulnerability is a directory traversal through the tab parameter, using modified dot-dot sequences ("../..//"), allowing remote attackers to read arbitrary files. The provided documents do not...

CVE-2008-1404

CVE-2008-1404 describes an SQL injection in the Viso (Industry Book) module for eXV2, affecting versions 2.04 and 2.03. The vulnerability is in index.php via the kid parameter, allowing remote attackers to execute arbitrary SQL commands. No remediation details are provided in the connected docume...

CVE-2008-1407

The provided connected documents identify a concrete vulnerability: an SQL injection in the WebChat 1.60 module for eXV2, affecting index.php. The vulnerability is triggered via the roomid parameter, enabling remote attackers to inject arbitrary SQL commands. The root cause is unsafe handling of ...

CVE-2008-1407: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in the WebChat 1.60 module for eXV2 allows remote attackers to execute arbitrary SQL commands via the roomid parameter...

CVE-2008-1415: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in Multiple Time Sheets MTS 5.0 and earlier allows remote attackers to read arbitrary files via "../..//" modified dot dot sequences in the tab parameter...