CVE-2006-6218

CVE-2006-6218 relates to dev4u CMS, where index.php is vulnerable to SQL injection via the (1) seite_id, (2) gruppe_id.php, and (3) go_target parameters. The root cause is improper handling/sanitization of input used in SQL queries, allowing remote attackers to alter the intended query and execut...

CVE-2006-6219

dev4u CMS is affected by multiple cross-site scripting (XSS) flaws in index.php, exploitable via the parameters (1) user_name, (2) passwort, and (3) go_target. The issue allows remote attackers to inject arbitrary web script or HTML. CVSSv2 base score is 6.8 (MEDIUM), with NETWORK attack vector, ...

CVE-2006-6219: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in index.php in dev4u CMS allow remote attackers to inject arbitrary web script or HTML via the 1 username, 2 passwort, and 3 gotarget parameters...

CVE-2006-6213: Undefined Security Weakness

index.php in PEGames uses the extract function to overwrite critical variables, which allows remote attackers to conduct PHP remote file inclusion attacks via the absurl parameter, which is later extracted to overwrite a previously uncontrolled value...

CVE-2006-6218: Undefined Security Weakness

Multiple SQL injection vulnerabilities in index.php in dev4u CMS allow remote attackers to execute arbitrary SQL commands via the 1 seiteid, 2 gruppeid.php, and 3 gotarget parameters...

CVE-2006-6200: Undefined Security Weakness

Multiple SQL injection vulnerabilities in the 1 ratearticle and 2 ratecomplete functions in modules/News/index.php in the News module in Francisco Burzi PHP-Nuke 7.9 and earlier, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the sid parameter...

Invision Gallery 2.0.7 SQL Injection Vulnerability

Invision Gallery 2.0.7 DOS attak can be performed index.php?automodule=gallery&cmd=postcomment&op=doaddcomment&Post=test&img=111 OR id IN SELECT BENCHMARK10000000,BENCHMARK10000000,md5currentdate FROM ipbgalleryimages...

snif <= 1.5.2 (index.php) Remote File Inclusion Vulnerability

No description provided by source. snif simple and nice index file Remote File Include Vulnerability Download Site: http://www.bitfolge.de/download/snif152.zip Found & Exploiting By: S.W.A.T. advistory: wWw.Xmors.CoM - wWw.XmorS.NeT POC:...

Wordpress Index.PHP跨站脚本漏洞

Wordpress是一款基于php的WEB应用程序。 Wordpress不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行跨站脚本获得敏感信息。 问题是由于'Index.PHP'脚本对用户提交的's'参数缺少过滤，提交恶意脚本代码作为参数数据，并诱使用户打开，可导致恶意脚本在目标浏览器上执行，可获得敏感信息。 WordPress WordPress 1.5 升级到Wordpress 2.0.6版本： http://wordpress.org/ http://www.example.com/wp-admin/edit.php?s=XSS&submit=Search...

CVE-2006-6157

ContentNow is affected by an SQL injection in index.php (v1.39 and earlier) that allows remote attackers to inject arbitrary SQL via the pageid parameter. The underlying issue can also expose path information when a non-existent/invalid pageid is provided. Affected product: ContentNow up to versi...

CVE-2006-6157: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in ContentNow 1.39 and earlier allows remote attackers to execute arbitrary SQL commands via the pageid parameter. NOTE: this issue can be leveraged for path disclosure with an invalid pageid parameter...

CVE-2006-6140: Undefined Security Weakness

PHP remote file inclusion vulnerability in Sisfo Kampus 2006 Semarang 3 allows remote attackers to execute arbitrary PHP code via a URL in the slnt parameter to 1 index.php and 2 print.php. NOTE: The provenance of this information is unknown; the details are obtained solely from third party...

Sisfo Kampus 0.8 - Remote File Inclusion / Download

Source Code = Sisfokampus 0.8 Website = www.Sisfokampus.net Author = E. Setio Dewo [email protected] Dorkz : Allinurl: /index.php?exec= File Vuln : index.php print.php download.php Local File Include Found by : Wawan Firmansyah a.k.a Ang|n [email protected] Source of index.php...

CVE-2006-6069

index.php in mAlbum 0.3 and earlier allows remote attackers to obtain the installation path via an invalid gal parameter...

CVE-2006-6069

CVE-2006-6069 affects mAlbum 0.3 and earlier; index.php is vulnerable to an invalid gal parameter, enabling remote attackers to obtain the installation path. The CVSS2 base score is 5.0 (NETWORK vector, low attack complexity, no authentication, partial confidentiality impact). No remediation deta...

CVE-2006-6069

index.php in mAlbum 0.3 and earlier allows remote attackers to obtain the installation path via an invalid gal parameter...

CVE-2006-6037

Multiple cross-site scripting XSS vulnerabilities in index.php in Dan Jensen Travelsized CMS 0.4.1 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 page, 2 pageid, or 3 language parameter...

CVE-2006-6047: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in manager/index.php in Etomite 0.6.1.2 allows remote authenticated administrators to include and execute arbitrary local files via a .. dot dot in the f parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then...

CVE-2006-6041: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Laurent Van den Reysen WORK system e-commerce 3.0.2, and other versions before 3.0.4, allow remote attackers to execute arbitrary PHP code via a URL in the ginclude parameter to 1 index.php, 2 module/forum/forum.php, 3 unspecified files under...

CVE-2006-6040: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in admincp/index.php in Jelsoft vBulletin 3.6.x allow remote attackers to inject arbitrary web script or HTML via 1 the prefs parameter in a buildnavprefs action or 2 the navprefs parameter in a savenavprefs action...