7216 matches found
CVE-2007-2737
Summary (CVE-2007-2737) : The XOOPS MyConference 1.0 module contains an SQL injection in index.php exploitable via the cid parameter. The issue allows a remote attacker to execute arbitrary SQL commands against the underlying database. This is reported in multiple sources (NVD entry and Checkpoin...
wikyblog-rfi.txt
WikyBlog-1.4.12index.php Remote File Include Vulnerability Found by : nkillers nkillersathotmail.com Download http://jaist.dl.sourceforge.net/sourceforge/wikyblog/WikyBlog-1.4.12.zip File: ./index.php requireonce$includeDir.'/wiki2.php'; requireonce$includeDir.'/wiki3.php'; Exploit...
Mambo Component com_yanc 1.4 Beta - id SQL Injection
Mambo Component comyanc 1.4 Beta - id SQL Injection ------------------------------ ------------------------------- Mambo comyanc v1.4 beta id Blind Remote SQL Injection Vuln ------------------------------------------------------------- Bulan: Cyber-Security...
Mambo Component com_yanc 1.4 Beta - 'id' SQL Injection
------------------------------ ------------------------------- Mambo comyanc v1.4 beta id Blind Remote SQL Injection Vuln ------------------------------------------------------------- Bulan: Cyber-Security ------------------------------------------------------------- Exploit:...
CVE-2007-2681
Directory traversal vulnerability in blogs/index.php in b2evolution 1.6 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the coresubdir parameter...
CVE-2007-2636
Unspecified vulnerability in phpTodo before 0.8.1 allows remote attackers to have an unknown impact via newlines in regular expressions to 1 index.php, 2 feed.php, 3 prefs.php, and 4 todolist.php; and 5 classTodoItem.php and 6 phpTodoUser.php in libs/. NOTE: some of these details are obtained fro...
Crlf injection
CRLF injection vulnerability in index.php in Drake CMS 0.4.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the lang parameter. NOTE: Drake CMS has only a beta version available, and the vendor has previously stated "We d...
CVE-2007-2618
The CVE-2007-2618 issue affects Drake CMS 0.4.0, identifying a CRLF injection vulnerability in index.php. The root cause is a CRLF sequence in the lang parameter that enables an attacker to inject arbitrary HTTP headers and perform HTTP response splitting. Public details describe the vulnerable c...
Remote file inclusion
Multiple PHP remote file inclusion vulnerabilities in gnuedu 1.3b2 allow remote attackers to execute arbitrary PHP code via a URL in the a ETCDIR parameter to 1 libs/lom.php; 2 lomupdate.php, 3 check-lom.php, and 4 weighkeywords.php in scripts/; the b LIBSDIR parameter to 5 logout.php, 6 help.php...
CVE-2007-2609
CVE-2007-2609 affects gnuedu 1.3b2 with multiple PHP remote file inclusion vulnerabilities . An attacker can trigger arbitrary PHP code execution by supplying untrusted values to the ETCDIR parameter for files/libs (libs/lom.php; lom_update.php; check-lom.php; weigh_keywords.php; web/lom.php) and...
Sql injection
SQL injection vulnerability in index.php in the wfquotes 1.0 0 module for XOOPS allows remote attackers to execute arbitrary SQL commands via the c parameter in a cat action...
CVE-2007-2574
The CVE-2007-2574 entry describes a directory traversal vulnerability in Archangel Weblog 0.90.02, where an attacker can read arbitrary files by supplying a .. (dot dot) path in the index parameter of index.php. This is caused by improper validation of the index parameter, enabling access to file...
Remote file inclusion
PHP remote file inclusion vulnerability in index.php in phpFullAnnu CMS pfa CMS 6.0 allows remote attackers to execute arbitrary PHP code via a URL in the repinc parameter. NOTE: CVE disputes this issue since $repinc is set to a constant value before use...
CVE-2007-2562
Cross-site scripting XSS vulnerability in index.php in Kayako eSupport 3.00.90 allows remote attackers to inject arbitrary web script or HTML via the m parameter...
CVE-2007-2558
CVE-2007-2558 concerns a PHP remote file inclusion in the web app pfa CMS (phpFullAnnu CMS) version 6.0, specifically in index.php via the repinc parameter. The vulnerability is described as enabling remote PHP code execution through a URL if repinc is used to include code. However, the CVE notes...
CVE-2007-2562
Vulnerability summary (CVE-2007-2562) : Kayako eSupport 3.00.90 is affected by a cross-site scripting (XSS) flaw in index.php, exploitable via the _m parameter. The underlying issue is unsanitized input passed through this parameter, allowing remote attackers to inject arbitrary web script or HTM...
CVE-2007-2562
Cross-site scripting XSS vulnerability in index.php in Kayako eSupport 3.00.90 allows remote attackers to inject arbitrary web script or HTML via the m parameter...
Directory traversal
Directory traversal vulnerability in Advanced Guestbook 2.4.2 allows remote attackers to bypass .htaccess settings, and execute arbitrary PHP local files or read arbitrary local templates, via a .. dot dot in a lang cookie, followed by a filename without its .php extension, as demonstrated via a...
CVE-2007-0609
Directory traversal vulnerability in Advanced Guestbook 2.4.2 allows remote attackers to bypass .htaccess settings, and execute arbitrary PHP local files or read arbitrary local templates, via a .. dot dot in a lang cookie, followed by a filename without its .php extension, as demonstrated via a...