Zen Cart 1.3.9f Local File Inclusion

Zen Cart v1.3.9f typefilter Local File Inclusion Vulnerability Vendor: Zen Ventures, LLC Product web page: http://www.zen-cart.com Version affected: 1.3.9f Summary: Zen Cart is an online store management system. It is PHP-based, using a MySQL database and HTML components. Support is provided for...

phpMyFAQ 2.6.x index.php跨站脚本漏洞

BUGTRAQ ID: 43560 phpMyFAQ是一款多语言、基于数据库的FAQ系统。 phpMyFAQ没有正确地过滤提交给index.php页面的请求参数便返回给了用户。远程攻击者可以通过提交恶意的URL请求向页面输出注入JavaScript代码，导致窃取域Cookie。 phpMyFAQ 2.6.x 厂商补丁： phpMyFAQ -------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.phpmyfaq.de/ http://www.example.com/index.php/"scriptalert"XSS"/script...

PHPMyFAQ 2.6.x - 'index.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/43560/info phpMyFAQ is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of t...

CVE-2010-3607

Cross-site scripting XSS vulnerability in AGENTS/index.php in NetArt MEDIA Real Estate Portal 2.0 allows remote authenticated users to inject arbitrary web script or HTML via the id parameter...

Sql injection

SQL injection vulnerability in index.php in ibPhotohost 1.1.2 allows remote attackers to execute arbitrary SQL commands via the img parameter...

CVE-2010-3601

SQL injection vulnerability in index.php in ibPhotohost 1.1.2 allows remote attackers to execute arbitrary SQL commands via the img parameter...

CVE-2010-3601

The CVE-2010-3601 entry describes a SQL injection in ibPhotohost 1.1.2, triggered via the img parameter in index.php. This affects the web application by allowing remote attackers to execute arbitrary SQL commands. CVSS data indicates a Network-based, Low-Complexity, No-Auth vulnerability with a ...

CVE-2010-3606

CVE-2010-3606 : In NetArt MEDIA Real Estate Portal 2.0, the file AGENTS/index.php is affected by directory traversal in the folder and action parameters, enabling remote attackers to include and execute arbitrary local files. The NVD description confirms the vulnerability and impact with a CVSS v...

WAnewsletter 2.1.2 - SQL Injection

WAnewsletter 2.1.2 - SQL Injection ================================================ WAnewsletter v 2.1.2 SQL Injection Vulnerability ================================================ Exploit Title: WAnewsletter v 2.1.2 SQL Injection Vulnerabilitie Date: 23/09/2010 Author: BrOx-Dz Author:...

ibPhotohost 1.1.2 - SQL Injection

ibPhotohost 1.1.2 - SQL Injection + + Title: ibPhotohost 1.1.2 SQL Injection + Author: fred777 - fred777.5x.to + Link: http://mods.invisionize.com/index.php/f/7609 + Vuln: index.php?autocom=photohost&CODE=04&img=SQL Injection + Greetzz to: back2hack,free-hack,hackbase,c-c + Contact:...

CVE-2010-3455

Cross-site scripting XSS vulnerability in index.php in AChecker 1.0 allows remote attackers to inject arbitrary web script or HTML via the uri parameter...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in admin/managerusers.class.php in SantaFox 2.02, and possibly earlier, allows remote attackers to hijack the authentication of administrators for requests, as demonstrated by adding administrative users via the saveadmin action to admin/index.php...

CVE-2010-3466

CVE-2010-3466 : The vulnerability is a stored/reflected cross-site scripting issue in the NetArt Media iBoutique.MALL 1.2 hosted_signup module, specifically in index.php via the tmpl parameter. The XSS allows remote attackers to inject arbitrary HTML/JavaScript. The affected component is the host...

CVE-2010-3455

CVE-2010-3455 is an XSS vulnerability in AChecker 1.0 . The flaw resides in the code path for index.php where the uri parameter is insufficiently sanitized, allowing remote attackers to inject arbitrary HTML/JavaScript. Demonstrated payloads and exploitation details appear in multiple sources (e....

CVE-2010-3418

Multiple cross-site scripting XSS vulnerabilities in NetArt Media Car Portal 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 carid parameter to index.php and 2 y parameter to include/images.php...

Joomla Component com_read SQL Injection Vulnerability

Exploit for php platform in category web applications ===================================================== Joomla Component comread SQL Injection vulnerability ===================================================== + Exploit Title : Joomla Component read SQL injection vulnerability + Author :...

Directory traversal

Directory traversal vulnerability in the PicSell compicsell component 1.0 for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the dflink parameter in a prevsell dwnfree action to index.php...

Cross site scripting

Cross-site scripting XSS vulnerability in ajax.php in Wiccle Web Builder WWB 1.00 and 1.0.1 allows remote attackers to inject arbitrary web script or HTML via the posttext parameter in a site customsearch action to index.php. NOTE: some of these details are obtained from third party information...

Global Event Source (index.php) Blind Sql Injection Vulnerability

Exploit for php platform in category web applications ================================================================= Global Event Source index.php Blind Sql Injection Vulnerability ================================================================= .:. Author : AtT4CKxT3rR0r1ST email protected ....

PHP Joke Site Software - sbjoke_id SQL Injection

PHP Joke Site Software - sbjokeid SQL Injection Title: PHP Joke Site Software sbjokeid SQL Injection Vuln Link: http://www.softbizscripts.com/jokes-script-features.php Author: BorN To K!LL - h4ck3r 3xploit:...