ezContents 1.4.5 (index.php link) Remote File Disclosure Vulnerability

No description provided by source. -------------------------------------------------------------- ezContents Version 1.4.5 Remote File Disclosure Vulnerability. -------------------------------------------------------------- download : http://www.visualshapers.com/ author : p4imi0 contact :...

EZContents 1.4.5 - index.php?link Remote File Disclosure

EZContents 1.4.5 - index.php?link Remote File Disclosure -------------------------------------------------------------- ezContents Version 1.4.5 Remote File Disclosure Vulnerability. -------------------------------------------------------------- download : http://www.visualshapers.com/ author :...

CVE-2007-6213

CVE-2007-6213 concerns WebED 0.0.9. Multiple directory traversal flaws in mod/chat/index.php allow remote reading of arbitrary files via a .. in the Root and Path parameters, affecting confidentiality (C:P) with no integrity/availability impact stated. CVSS v2 score is 5.0 (Medium) with network a...

CVE-2007-6233: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in FTP Admin 0.1.0 allows remote authenticated users to include and execute arbitrary local files via a .. dot dot in the page parameter. NOTE: in some environments, this can be leveraged for remote file inclusion by using a UNC share pathname or an...

CVE-2007-6213: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in mod/chat/index.php in WebED 0.0.9 allow remote attackers to read arbitrary files via a .. dot dot in the 1 Root and 2 Path parameters...

CVE-2007-6234: Improper Authentication

index.php in FTP Admin 0.1.0 allows remote attackers to bypass authentication and obtain administrative access via a loggedin parameter with a value of true, as demonstrated by adding a user account...

Project Alumni Index.PHP Act参数本地文件包含漏洞

Project Alumni是一款基于PHP的WEB应用程序。 Project Alumni不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB权限查看系统文件内容。 问题是由于'Index.PHP'脚本对用户提交的'act'参数缺少过滤，提交包含多个"../"字符作为参数数据，可绕过WEB ROOT限制，以WEB权限查看系统文件内容。 Project Alumni 1.0.9 目前没有解决方案提供： https://sourceforge.net/projects/project-alumni/...

CVE-2007-6232: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in FTP Admin 0.1.0 allows remote attackers to inject arbitrary web script or HTML via the error parameter in an error page action...

webed-disclose.txt

WebED v0.0.9 index.php Remote File Disclosure Vulnerabilities Script : http://heanet.dl.sourceforge.net/sourceforge/ed-engine/WebEDv0.0.9.tar.gz Vuln Code In /mod/chat/index.php : PoC : /mod/chat/index.php?Root=../../../../../../etc/passwd /mod/chat/index.php?Path=../../../../../../etc/pa...

CVE-2007-6184: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in Project Alumni 1.0.9 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the act parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in index.php in Tilde CMS 4.x and earlier allows remote attackers to inject arbitrary web script or HTML via the aarstal parameter in a yeardetail action...

Cross site scripting

Cross-site scripting XSS vulnerability in index.php in SimpleGallery 0.1.3 allows remote attackers to inject arbitrary web script or HTML via the album parameter...

CVE-2007-6162

Cross-site scripting XSS vulnerability in index.php in FMDeluxe 2.1.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter in a category action...

CVE-2007-6160

CVE-2007-6160 describes a cross-site scripting (XSS) vulnerability in the index.php of Tilde CMS 4.x and earlier . The issue allows remote attackers to inject arbitrary web script or HTML via the aarstal parameter in a yeardetail action. The provided documents confirm the affected product/version...

CVE-2007-6159

The CVE-2007-6159 entry describes an SQL injection in index.php of Tilde CMS 4.x and earlier, exploitable via the aarstal parameter in the yeardetail action. This allows remote attackers to execute arbitrary SQL commands and is noted as a vector different from CVE-2006-1500.

CVE-2007-6161

index.php in Tilde CMS 4.x and earlier allows remote attackers to obtain sensitive information via a certain search parameter value in a search action, which reveals the path...

WebED 0.0.9 (index.php) Remote File Disclosure Vulnerability

No description provided by source. WebED v0.0.9 index.php Remote File Disclosure Vulnerabilities Script : http://heanet.dl.sourceforge.net/sourceforge/ed-engine/WebEDv0.0.9.tar.gz Vuln Code In /mod/chat/index.php : body ?php readfile$Root.$Path; ? ---xxx form action="applicationloader.php"...

CVE-2007-6159: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in Tilde CMS 4.x and earlier allows remote attackers to execute arbitrary SQL commands via the aarstal parameter in a yeardetail action, a different vector than CVE-2006-1500...

WebED 0.0.9 - index.php Remote File Disclosure

WebED 0.0.9 - index.php Remote File Disclosure WebED v0.0.9 index.php Remote File Disclosure Vulnerabilities Script : http://heanet.dl.sourceforge.net/sourceforge/ed-engine/WebEDv0.0.9.tar.gz Vuln Code In /mod/chat/index.php : PoC : /mod/chat/index.php?Root=../../../../../../etc/passwd...

CVE-2007-6162: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in FMDeluxe 2.1.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter in a category action...