CVE-2007-1050

Multiple cross-site scripting XSS vulnerabilities in index.php in AbleDesign MyCalendar allow remote attackers to inject arbitrary web script or HTML via 1 the go parameter, 2 the keyword parameter in the search menu go=search, or 3 the username or 4 the password in a go=Login action...

CVE-2007-1055

CVE-2007-1055 is an XSS vulnerability in MediaWiki’s AJAX features (index.php) affecting MediaWiki 1.9.x before 1.9.0rc2 and 1.8.2 and earlier. The issue allows remote attackers to inject arbitrary script/HTML via the rs parameter. It is noted as possibly a duplicate of CVE-2007-0177. The connect...

CVE-2007-1050

CVE-2007-1050 describes multiple cross-site scripting (XSS) vulnerabilities in index.php of AbleDesign MyCalendar. The issue allows remote attackers to inject arbitrary web script or HTML via the following input points: (1) the go parameter, (2) the keyword parameter in the search menu (go=search...

EUVD-2007-1047

Multiple cross-site scripting XSS vulnerabilities in index.php in AbleDesign MyCalendar allow remote attackers to inject arbitrary web script or HTML via 1 the go parameter, 2 the keyword parameter in the search menu go=search, or 3 the username or 4 the password in a go=Login action...

CVE-2007-1054

Cross-site scripting XSS vulnerability in the AJAX features in index.php in MediaWiki 1.6.x through 1.9.2, when $wgUseAjax is enabled, allows remote attackers to inject arbitrary web script or HTML via a UTF-7 encoded value of the rs parameter, which is processed by Internet Explorer...

CVE-2007-1020

Cross-site scripting XSS vulnerability in index.php in CedStat 1.31 allows remote attackers to inject arbitrary web script or HTML via the hier parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in index.php in CedStat 1.31 allows remote attackers to inject arbitrary web script or HTML via the hier parameter...

CVE-2007-1020

CVE-2007-1020 affects CedStat 1.31, with an XSS flaw in index.php exploited via the hier parameter. The root cause is insufficient sanitization allowing remote script injection. Impact per CVSS 2.0: Partial confidentiality, integrity, and availability (base score 6.8). Connected documents provide...

CVE-2007-1020

Cross-site scripting XSS vulnerability in index.php in CedStat 1.31 allows remote attackers to inject arbitrary web script or HTML via the hier parameter...

CedStat 1.31 - 'index.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/22653/info CedStat is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the...

CVE-2007-0986

Jupiter CMS 1.1.5 is affected by a PHP remote file inclusion in index.php when running PHP 5.0.0 or later. An attacker can supply an ftp URL in the n parameter to execute arbitrary PHP code on the affected system. The available documents confirm the vulnerability class and target version, but do ...

CVE-2007-0971

Multiple SQL injection vulnerabilities in Jupiter CMS 1.1.5 allow remote attackers to execute arbitrary SQL commands via the Client-IP HTTP header and certain other HTTP headers, which set the ip variable that is used in SQL queries performed by index.php and certain other PHP scripts. NOTE: the...

Sql injection

Multiple SQL injection vulnerabilities in Jupiter CMS 1.1.5 allow remote attackers to execute arbitrary SQL commands via the Client-IP HTTP header and certain other HTTP headers, which set the ip variable that is used in SQL queries performed by index.php and certain other PHP scripts. NOTE: the...

CVE-2007-0971

Multiple SQL injection vulnerabilities in Jupiter CMS 1.1.5 allow remote attackers to execute arbitrary SQL commands via the Client-IP HTTP header and certain other HTTP headers, which set the ip variable that is used in SQL queries performed by index.php and certain other PHP scripts. NOTE: the...

CVE-2007-0971

Jupiter CMS 1.1.5 is affected by multiple SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands via the Client-IP HTTP header and other headers that set the ip variable used in queries in index.php and related PHP scripts. This is the underlying cause: input ...

CVE-2006-7022

The CVE-2006-7022 entry concerns fx-APP 0.0.8.1, where the Tools module allows remote attackers to misrepresent a web page’s contents by supplying an arbitrary URL in the url parameter to the showhtml action of index.php, causing that URL to render inside an iframe. The available description expl...

LightRO CMS 1.0 - 'index.php?projectid' SQL Injection

exploit2.asp 'Update: + Get Header 'Update: + Get Whois Info '=============================================================================================== % function functionControl1 setTimeout"functionControl2",2000; function functionControl2 ifdocument.form1.field1.value=="" alert"Exploit...

Directory traversal

Multiple directory traversal vulnerabilities in Cedric CLAIRE PortailPhp 2 allow remote attackers to read arbitrary files via a .. dot dot in the chemin parameter to 1 modnews/index.php or 2 modnews/goodies.php. NOTE: The provenance of this information is unknown; the details are obtained solely...

CVE-2007-0821

CVE-2007-0821 describes multiple directory traversal vulnerabilities in Cedric CLAIRE PortailPhp 2. An attacker can read arbitrary files by injecting a .. sequence into the chemin parameter of two PHP scripts: mod_news/index.php and mod_news/goodies.php. The underlying issue is improper validatio...

Remote file inclusion

PHP remote file inclusion vulnerability in index.php in Miguel Nunes Call of Duty 2 CoD2 DreamStats System 4.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the rootpath parameter...