11752 matches found
CVE-2007-6374
Multiple cross-site scripting XSS vulnerabilities in Bitweaver 2.0.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to 1 users/register.php or 2 search/index.php, or an editcomments action in 3 wiki/index.php or 4 forums/index.php. NOTE: the error...
CVE-2007-6374: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in Bitweaver 2.0.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to 1 users/register.php or 2 search/index.php, or an editcomments action in 3 wiki/index.php or 4 forums/index.php. NOTE: the error...
CVE-2007-6375: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL injection vulnerabilities in Bitweaver 2.0.0 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 sortmode parameter to wiki/listpages.php and the 2 highlight parameter to search/index.php. NOTE: the researcher also reported injection via JavaScript code in...
CVE-2007-6368: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in index.php in ezContents 1.4.5 allows remote attackers to read arbitrary files via a .. dot dot in the link parameter...
CVE-2007-6362: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in index.php in the RSGallery comrsgallery 2.0 beta 5 and earlier component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in an inline page action...
CVE-2007-6344: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in modules/cms/index.php in Mcms Easy Web Make 1.3, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the template parameter...
CVE-2007-6310
Multiple cross-site scripting XSS vulnerabilities in Falt4Extreme RC4 10.9.2007 allow remote attackers to inject arbitrary web script or HTML via the handler parameter to 1 index.php and possibly 2 admin/index.php, and 3 the topic parameter to modules/feed/feed.php aka modules/feed.php...
CVE-2007-6310
Multiple cross-site scripting XSS vulnerabilities in Falt4Extreme RC4 10.9.2007 allow remote attackers to inject arbitrary web script or HTML via the handler parameter to 1 index.php and possibly 2 admin/index.php, and 3 the topic parameter to modules/feed/feed.php aka modules/feed.php...
CVE-2007-6309
Multiple cross-site scripting XSS vulnerabilities in index.php in webSPELL 4.1.2 allow remote attackers to inject arbitrary web script or HTML via 1 the galleryID parameter in a usergallery upload action; or the 2 upID, 3 tag, 4 month, 5 userID, or 6 year parameter in a calendar announce action...
Mcms Easy Web Make (index.php template) Local File Inclusion Vuln
Exploit for unknown platform in category web applications ================================================================= Mcms Easy Web Make index.php template Local File Inclusion Vuln =================================================================...
CVE-2007-6309: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in index.php in webSPELL 4.1.2 allow remote attackers to inject arbitrary web script or HTML via 1 the galleryID parameter in a usergallery upload action; or the 2 upID, 3 tag, 4 month, 5 userID, or 6 year parameter in a calendar announce action...
CVE-2007-6311: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in 1 index.php, and possibly 2 admin/index.php, in Falt4Extreme RC4 10.9.2007 allows remote attackers to execute arbitrary SQL commands via the navID parameter...
CVE-2007-6310: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in Falt4Extreme RC4 10.9.2007 allow remote attackers to inject arbitrary web script or HTML via the handler parameter to 1 index.php and possibly 2 admin/index.php, and 3 the topic parameter to modules/feed/feed.php aka modules/feed.php...
Joomla! Index.PHP SQL注入漏洞
Joomla!是一款基于PHP的WEB应用程序。 Joomla!不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击，可获得敏感信息或操作数据库。 问题是由于'Index.PHP'脚本对用户提交的WEB参数缺少过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。 Joomla 1.5 RC3 目前没有解决方案提供： http://www.joomla.org/component/option,comfrontpage/Itemid,1/...
CVE-2007-6266: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL injection vulnerabilities in bcoos 1.0.10 and earlier allow remote attackers to execute arbitrary SQL commands via 1 the gid parameter to modules/arcade/index.php in a showstats action, or the lid parameter to 2 modules/myalbum/ratephoto.php or 3 modules/mylinks/ratelink.php, differe...
CVE-2007-6272: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL injection vulnerabilities in index.php in Joomla! 1.5 RC3 allow remote attackers to execute arbitrary SQL commands via 1 the view parameter to the comcontent component, 2 the task parameter to the comsearch component, or 3 the option parameter in a search action to the comsearch...
ezContents 1.4.5 (index.php link) Remote File Disclosure Vulnerability
No description provided by source. -------------------------------------------------------------- ezContents Version 1.4.5 Remote File Disclosure Vulnerability. -------------------------------------------------------------- download : http://www.visualshapers.com/ author : p4imi0 contact :...
EZContents 1.4.5 - index.php?link Remote File Disclosure
EZContents 1.4.5 - index.php?link Remote File Disclosure -------------------------------------------------------------- ezContents Version 1.4.5 Remote File Disclosure Vulnerability. -------------------------------------------------------------- download : http://www.visualshapers.com/ author :...
CVE-2007-6213
CVE-2007-6213 concerns WebED 0.0.9. Multiple directory traversal flaws in mod/chat/index.php allow remote reading of arbitrary files via a .. in the Root and Path parameters, affecting confidentiality (C:P) with no integrity/availability impact stated. CVSS v2 score is 5.0 (Medium) with network a...
CVE-2007-6233: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in index.php in FTP Admin 0.1.0 allows remote authenticated users to include and execute arbitrary local files via a .. dot dot in the page parameter. NOTE: in some environments, this can be leveraged for remote file inclusion by using a UNC share pathname or an...