7597 matches found
Mambo Site Server index.php mos_change_template XSS
An attacker may use the installed version of Mambo Site Server to perform a cross site scripting attack on this host. OpenVAS Vulnerability Test $Id: mamboxss3.nasl 9087 2018-03-12 17:24:24Z cfischer $ Description: Mambo Site Server index.php moschangetemplate XSS Authors: David Maciejak Updated:...
CVE-2005-3432
MiniGal 2 MG2 0.5.1 allows remote attackers to list password protected images via a request to index.php with the list parameter set to wildcard and the page parameter set to all...
CVE-2005-3432
The CVE-2005-3432 issue affects MiniGal 2 (MG2) 0.5.1, where a remote attacker can cause listing of password-protected images by sending a request to index.php with list = * and page = all. The public sources describe the vulnerability as an information-disclosure flaw allowing access to protecte...
Invision Gallery 2.0.3 - index.php SQL Injection
Invision Gallery 2.0.3 - index.php SQL Injection source: https://www.securityfocus.com/bid/15240/info Invision Gallery is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful...
Invision Gallery 2.0.3 - 'index.php' SQL Injection
source: https://www.securityfocus.com/bid/15240/info Invision Gallery is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation could result in a compromise of the...
CVE-2005-3365
Multiple SQL injection vulnerabilities in DCP-Portal 6 and earlier allow remote attackers to execute arbitrary SQL commands, possibly requiring encoded characters, via 1 the name parameter in register.php, 2 the email parameter in lostpassword.php, 3 the year parameter in calendar.php, and the 4...
CVE-2005-3366
The CVE-2005-3366 issue affects PHP iCalendar (PHP iCalendar 2.0a2–2.0.1). The vulnerability is a PHP file inclusion flaw in index.php that uses the phpicalendar cookie to include files, allowing remote code execution and arbitrary local file inclusion. The issue is not XSS per the report. Impact...
CVE-2005-3365
Multiple SQL injection vulnerabilities in DCP-Portal 6 and earlier allow remote attackers to execute arbitrary SQL commands, possibly requiring encoded characters, via 1 the name parameter in register.php, 2 the email parameter in lostpassword.php, 3 the year parameter in calendar.php, and the 4...
CVE-2005-3334
CVE-2005-3334 concerns Flyspray, a lightweight bug-tracking web app. The vulnerability affects Flyspray 0.9.7 through 0.9.8 (devel) and is a cross-site scripting (XSS) flaw in the index.php page. An attacker can inject arbitrary web script or HTML via multiple parameters (PHPSESSID, task, string,...
CVE-2005-3306
CVE-2005-3306 describes an XSS vulnerability in index.php of FlatNuke 2.5.6, exploitable via the user parameter in a profile operation to inject arbitrary script/HTML. The vulnerability is specifically a cross-site scripting issue and is stated as a separate/vector from CVE-2005-2814, with a note...
CVE-2005-3308
Multiple cross-site scripting XSS vulnerabilities in Zomplog 3.4 allow remote attackers to inject arbitrary web script or HTML via the 1 name or 2 comment parameter in detail.php, 3 the username parameter in get.php, and 4 the search parameter in index.php...
CVE-2004-2511
Multiple cross-site scripting XSS vulnerabilities in DCP-Portal 5.3.2 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the year, 2 month, and 3 day parameters in calendar.php; 4 the cid and 5 url parameters in index.php; 6 the cid parameter in annoucement.php; 7 the...
FlatNuke < 2.5.7 index.php Traversal File Inclusion
Binary data 3265.prm...
CVE-2005-3083
Cross-site scripting XSS vulnerability in index.php in CMS Made Simple 0.10 allows remote attackers to inject arbitrary web script or HTML via the page parameter...
CVE-2005-3083
CMS Made Simple 0.10 contains a cross-site scripting (XSS) vulnerability in index.php via the page parameter. Root cause is improper handling of the page parameter leading to script/HTML injection; impact implied is partial integrity compromise. CVSS 2.0 base score: 4.3 (Medium); vector: AV:N/AC:...
CVE-2005-3020
Multiple cross-site scripting XSS vulnerabilities in vBulletin before 3.0.9 allow remote attackers to inject arbitrary web script or HTML via the 1 group parameter to css.php, 2 redirect parameter to index.php, 3 email parameter to user.php, 4 goto parameter to language.php, 5 orderby parameter t...
CVE-2005-3004
SQL injection vulnerability in Interakt MX Shop 3.2.0 allows remote attackers to execute arbitrary SQL commands via the 1 idp, 2 idctg, or 3 idprd parameters to the pages module in index.php...
CVE-2005-3009
Cross-site scripting XSS vulnerability in CuteNews allows remote attackers to inject arbitrary web script or HTML via the mod parameter to index.php...
CVE-2005-3003
The CVE-2005-3003 entry concerns NooTopList 1.0.0 release 17, specifically in index.php. The vulnerability is a SQL injection in the application’s handling of the (1) o and (2) sort parameters, enabling remote attackers to execute arbitrary SQL commands. The NVD metrics indicate a high base sever...