Directory traversal

Directory traversal vulnerability in index.php in xtcommerce allows remote attackers to read arbitrary files via a .. dot dot in the template parameter...

CVE-2007-1126

CVE-2007-1126 affects xtcommerce via a directory-traversal flaw in index.php where the template parameter can be manipulated with .. to read arbitrary files. The root cause is improper sanitization of the template parameter, enabling unauthorized file access. Documentation lists the vulnerability...

CVE-2006-7083: Undefined Security Weakness

Directory traversal vulnerability in index.php in Rigter Portal System RPS 1.0, 2.0, and 3.0 allows remote attackers to read arbitrary files via ".." sequences in the id parameter...

CVE-2007-1135: Undefined Security Weakness

Multiple SQL injection vulnerabilities in WebMplayer before 0.6.1-Alpha allow remote attackers to execute arbitrary SQL commands via the 1 strid parameter to index.php and the 2 id0 or other id array index parameter to filecheck.php...

CVE-2007-1145: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Kayako SupportSuite - ESupport 3.00.13 and 3.04.10 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to a 1 lostpassword or 2 register action in index.php, 3 unspecified vectors in the Submit form in ...

CVE-2006-7072: Undefined Security Weakness

Cross-site scripting XSS vulnerability in GeoClassifieds Enterprise 2.0.5.2 and earlier allows remote attackers to inject arbitrary web script and HTML via the 1 busername and 2 c parameters to a index.php, the busername parameter to b admin/index.php, and 3 cphone parameter to register.php...

CVE-2007-1148: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in install/index.php in LoveCMS 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the step parameter...

CVE-2007-1152: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in Pyrophobia 2.1.3.1 allow remote attackers to read arbitrary files via a .. dot dot in the 1 act or 2 pid parameter to the top-level URI index.php, or the 3 action parameter to admin/index.php. NOTE: some of these details are obtained from third part...

CVE-2007-1126: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in xtcommerce allows remote attackers to read arbitrary files via a .. dot dot in the template parameter...

CVE-2007-1136: Improper Input Validation

index.php in WebMplayer before 0.6.1-Alpha allows remote attackers to execute arbitrary code via shell metacharacters in an exec function call. NOTE: some sources have referred to this as eval injection in the param parameter, but CVE source inspection suggests that this is erroneous...

CVE-2007-1108

The CVE-2007-1108 entry describes a PHP remote file inclusion vulnerability in the index.php of Christian Schneider CS-Gallery 2.0 and earlier. The issue allows remote attackers to execute arbitrary PHP code by supplying a URL in the album parameter during a securealbum todo action. Affected soft...

CVE-2007-1101

Multiple cross-site scripting XSS vulnerabilities in Photostand 1.2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 message "comment" or 2 name field, or the 3 q parameter in a search action in index.php...

CVE-2007-1101: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Photostand 1.2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 message "comment" or 2 name field, or the 3 q parameter in a search action in index.php...

CVE-2007-1102: Undefined Security Weakness

Photostand 1.2.0 allows remote attackers to obtain sensitive information via a ' quote character in 1 a PHPSESSID cookie or 2 the id parameter in an article action in index.php, which reveal the path in various error messages...

CVE-2007-1108: Undefined Security Weakness

PHP remote file inclusion vulnerability in index.php in Christian Schneider CS-Gallery 2.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the album parameter during a securealbum todo action...

PhotoStand 1.2 - 'index.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/22707/info PhotoStand is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in t...

CS-Gallery 2.0 (index.php album) Remote File Include Exploit

Exploit for unknown platform in category web applications ============================================================ CS-Gallery 2.0 index.php album Remote File Include Exploit ============================================================ ?php //File Inclusion Exploit for CSGallery = 2.0 //|...

flashgame154-rfi.txt

-------------------------------------------------------- Author : JuMp-Er Date : feb, 21th 2007 Level : Dangerous contact: : aH-crewathotmaildotcom -------------------------------------------------------- Software description -------------------------------------------------------- App...

CVE-2006-7042: Undefined Security Weakness

Cross-site scripting XSS vulnerability in directory/index.php in Chipmunk directory allows remote attackers to inject arbitrary web script or HTML via the start parameter...

CVE-2006-7055: Undefined Security Weakness

PHP remote file inclusion vulnerability in index.php in TotalCalendar 2.30 and earlier allows remote attackers to execute arbitrary code via a URL in the incdir parameter, a different vector than CVE-2006-1922...