7216 matches found
CVE-2007-6368
The CVE-2007-6368 entry concerns ezContents 1.4.5, where a directory traversal flaw in index.php allows remote attackers to read arbitrary files via a .. (dot dot) in the link parameter. This vulnerability is documented across multiple sources (NVD, CVE List, PRION, PRion, etc.), indicating the a...
CVE-2007-6374
CVE-2007-6374 concerns multiple XSS flaws in Bitweaver 2.0.0 and earlier, exploitable via PATH_INFO in four endpoints: /users/register.php, /search/index.php, /wiki/index.php (editcomments action), and /forums/index.php. The vulnerability allows remote attackers to inject arbitrary script or HTML...
CVE-2007-6374
Multiple cross-site scripting XSS vulnerabilities in Bitweaver 2.0.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to 1 users/register.php or 2 search/index.php, or an editcomments action in 3 wiki/index.php or 4 forums/index.php. NOTE: the error...
CVE-2007-6375
CVE-2007-6375 affects Bitweaver 2.0.0 and earlier. The vulnerability comprises multiple SQL injection flaws that allow remote attackers to execute arbitrary SQL commands via (1) the sort_mode parameter to wiki/list_pages.php and (2) the highlight parameter to search/index.php. A report also menti...
CVE-2007-6310
Multiple cross-site scripting XSS vulnerabilities in Falt4Extreme RC4 10.9.2007 allow remote attackers to inject arbitrary web script or HTML via the handler parameter to 1 index.php and possibly 2 admin/index.php, and 3 the topic parameter to modules/feed/feed.php aka modules/feed.php...
CVE-2007-6310
Multiple cross-site scripting XSS vulnerabilities in Falt4Extreme RC4 10.9.2007 allow remote attackers to inject arbitrary web script or HTML via the handler parameter to 1 index.php and possibly 2 admin/index.php, and 3 the topic parameter to modules/feed/feed.php aka modules/feed.php...
CVE-2007-6309
Multiple cross-site scripting XSS vulnerabilities in index.php in webSPELL 4.1.2 allow remote attackers to inject arbitrary web script or HTML via 1 the galleryID parameter in a usergallery upload action; or the 2 upID, 3 tag, 4 month, 5 userID, or 6 year parameter in a calendar announce action...
Mcms Easy Web Make (index.php template) Local File Inclusion Vuln
Exploit for unknown platform in category web applications ================================================================= Mcms Easy Web Make index.php template Local File Inclusion Vuln =================================================================...
Joomla! Index.PHP SQL注入漏洞
Joomla!是一款基于PHP的WEB应用程序。 Joomla!不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击，可获得敏感信息或操作数据库。 问题是由于'Index.PHP'脚本对用户提交的WEB参数缺少过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。 Joomla 1.5 RC3 目前没有解决方案提供： http://www.joomla.org/component/option,comfrontpage/Itemid,1/...
ezContents 1.4.5 (index.php link) Remote File Disclosure Vulnerability
No description provided by source. -------------------------------------------------------------- ezContents Version 1.4.5 Remote File Disclosure Vulnerability. -------------------------------------------------------------- download : http://www.visualshapers.com/ author : p4imi0 contact :...
EZContents 1.4.5 - index.php?link Remote File Disclosure
EZContents 1.4.5 - index.php?link Remote File Disclosure -------------------------------------------------------------- ezContents Version 1.4.5 Remote File Disclosure Vulnerability. -------------------------------------------------------------- download : http://www.visualshapers.com/ author :...
CVE-2007-6213
CVE-2007-6213 concerns WebED 0.0.9. Multiple directory traversal flaws in mod/chat/index.php allow remote reading of arbitrary files via a .. in the Root and Path parameters, affecting confidentiality (C:P) with no integrity/availability impact stated. CVSS v2 score is 5.0 (Medium) with network a...
Project Alumni Index.PHP Act参数本地文件包含漏洞
Project Alumni是一款基于PHP的WEB应用程序。 Project Alumni不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB权限查看系统文件内容。 问题是由于'Index.PHP'脚本对用户提交的'act'参数缺少过滤，提交包含多个"../"字符作为参数数据，可绕过WEB ROOT限制，以WEB权限查看系统文件内容。 Project Alumni 1.0.9 目前没有解决方案提供： https://sourceforge.net/projects/project-alumni/...
webed-disclose.txt
WebED v0.0.9 index.php Remote File Disclosure Vulnerabilities Script : http://heanet.dl.sourceforge.net/sourceforge/ed-engine/WebEDv0.0.9.tar.gz Vuln Code In /mod/chat/index.php : PoC : /mod/chat/index.php?Root=../../../../../../etc/passwd /mod/chat/index.php?Path=../../../../../../etc/pa...
Cross site scripting
Cross-site scripting XSS vulnerability in index.php in Tilde CMS 4.x and earlier allows remote attackers to inject arbitrary web script or HTML via the aarstal parameter in a yeardetail action...
Cross site scripting
Cross-site scripting XSS vulnerability in index.php in SimpleGallery 0.1.3 allows remote attackers to inject arbitrary web script or HTML via the album parameter...
CVE-2007-6162
Cross-site scripting XSS vulnerability in index.php in FMDeluxe 2.1.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter in a category action...
CVE-2007-6160
CVE-2007-6160 describes a cross-site scripting (XSS) vulnerability in the index.php of Tilde CMS 4.x and earlier . The issue allows remote attackers to inject arbitrary web script or HTML via the aarstal parameter in a yeardetail action. The provided documents confirm the affected product/version...
CVE-2007-6159
The CVE-2007-6159 entry describes an SQL injection in index.php of Tilde CMS 4.x and earlier, exploitable via the aarstal parameter in the yeardetail action. This allows remote attackers to execute arbitrary SQL commands and is noted as a vector different from CVE-2006-1500.