Cross site scripting

Cross-site scripting XSS vulnerability in the Files module in Kasseler CMS 1.3.0 and 1.3.1 Lite allows remote attackers to inject arbitrary web script or HTML via the cid parameter in a Category action to index.php...

CVE-2007-3650

myWebland myBloggie 2.1.6 allow remote attackers to obtain sensitive information via 1 an invalid year parameter to calendar.php, reached through index.php; 2 a direct request to common.php; and 3 a mode array parameter in the query string to login.php, which reveal the installation path in vario...

Design/Logic Flaw

myWebland myBloggie 2.1.6 allow remote attackers to obtain sensitive information via 1 an invalid year parameter to calendar.php, reached through index.php; 2 a direct request to common.php; and 3 a mode array parameter in the query string to login.php, which reveal the installation path in vario...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Farsi Script aka FaScript FaName 1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 key or 2 desc parameter to index.php, or 3 the name parameter to page.php...

joomlamygallery-sql.txt

H-T Team HouSSamix & ToXiC350 ===================================================================== Joomla Component mygallery Remote SQL Injection Exploit ===================================================================== AUTHOR : HouSSamix From H-T TeaM Script : mygallery Joomla Component...

sispletcms-sql.txt

================================================================= Sisplet CMS index.php id Remote SQL Injection Vulnerability ================================================================= ,--^----------,--------,-----,-------^--, | ||||||||| --------' | O .. CWH Underground Hacking Team...

cmslittle-lfi.txt

====================================================================== CMS little index.php template Local File Inclusion Vulnerability ====================================================================== ,--^----------,--------,-----,-------^--, | ||||||||| --------' | O .. CWH Underground...

CVE-2007-3653

Multiple cross-site scripting XSS vulnerabilities in Farsi Script aka FaScript FaName 1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 key or 2 desc parameter to index.php, or 3 the name parameter to page.php...

Directory traversal

Directory traversal vulnerability in index.php in Simple PHP Agenda 2.2.4 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the page parameter...

WebBlizzard CMS 'index.php' SQL注入漏洞

BUGTRAQ ID: 30074 CNCAN ID：CNCAN-2008070701 WebBlizzard CMS是一款基于PHP的WEB应用程序。 WebBlizzard CMS不正确处理用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，可能获得敏感信息或操作数据库。 问题由于'index.php'脚本对用户提交给WEB参数缺少过滤，构建恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。 WebBlizzard CMS 目前没有解决方案提供： http://www.webblizzard.de/ /usr/bin/perl |+| Vendor...

Directory traversal

Multiple directory traversal vulnerabilities in index.php in FOG Forum 0.8.1 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the 1 foglang and 2 fogskin parameters, probably related to libs/required/share.inc; and possibly the 3 fogpseudo, 4 fogposted, 5...

CVE-2008-2996

GBX 2.0 Beta (Gravity Board X) has multiple SQL injection vulnerabilities in index.php. Specifically, two parameters are exploitable: searchquery in getsearch and board_id in viewboard, and these issues occur when magic_quotes_gpc is disabled. The CVE-2008-2996 entry documents remote execution of...

CMS little (index.php template) Local File Inclusion Vulnerability

No description provided by source. ====================================================================== CMS little index.php template Local File Inclusion Vulnerability ====================================================================== ,--^----------,--------,-----,-------^--, | |||||||||...

CMS WebBlizzard (index.php page) Blind SQL Injection Exploit

Exploit for unknown platform in category web applications...

Sql injection

SQL injection vulnerability in index.php in Demo4 CMS 01 Beta allows remote attackers to execute arbitrary SQL commands via the id parameter...

Sql injection

SQL injection vulnerability in index.php in KbLance allows remote attackers to execute arbitrary SQL commands via the catid parameter in a comment action...

Sql injection

SQL injection vulnerability in index.php in HoMaP-CMS 0.1 allows remote attackers to execute arbitrary SQL commands via the go parameter...

CVE-2008-2962

Multiple cross-site scripting XSS vulnerabilities in MyBlog allow remote attackers to inject arbitrary web script or HTML via the 1 s and 2 sort parameters to index.php, and the 3 id parameter to post.php...

Session fixation

Multiple session fixation vulnerabilities in Academic Web Tools AWT YEKTA 1.4.3.1, and 1.4.2.8 and earlier, allow remote attackers to hijack web sessions by setting the PHPSESSID parameter to 1 index.php and 2 login.php in homepg/...

CVE-2008-2972

CVE-2008-2972 describes a SQL injection vulnerability in the KbLance product, where the index.php comment action accepts a malicious value in the cat_id parameter, allowing an attacker to execute arbitrary SQL commands. This is documented across multiple sources (NVD entry, CVE records, and relat...