CVE-2013-5588: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Cacti 0.8.8b and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the step parameter to install/index.php or 2 the id parameter to cacti/host.php...

Kleeja Upload Center Script CRLF Injection

Exploit Title : Kleeja Upload Center Script CRLF injection Author:Ashiyane Digital Security Team home: http://ashiyane.org/forums version:1.0.1 software link: www.Kleeja.com Date:Sunday - 2012 25 November Google Dork: intext:Kleeja © 2007-2012. All rights reserved Type: CRLF injection Tested...

CVE-2012-5385: Undefined Security Weakness

install/index.php in Craig Knudsen WebCalendar before 1.2.5 allows remote attackers to modify settings.php and possibly execute arbitrary code via vectors related to the user theme preference...

WebCalendar 1.2.4 - Remote Code Execution

?php / ----------------------------------------------------------------------- WebCalendar = 1.2.4 install/index.php Remote Code Executionn Exploit ----------------------------------------------------------------------- author..........: Egidio Romano aka EgiX mail............:...

CVE-2008-6597: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in upload/install/index.php in PHCDownload 1.1 allows remote attackers to inject arbitrary web script or HTML via the step parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-1371: Improper Limitation of a Pathname to a Restricted Directory

Absolute path traversal vulnerability in install/index.php in Drake CMS 0.4.11 RC8 allows remote attackers to read and execute arbitrary files via a full pathname in the droot parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

CVE-2008-0612: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in htdocs/install/index.php in XOOPS 2.0.18 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the lang parameter...

CVE-2007-2311: Undefined Security Weakness

PHP remote file inclusion vulnerability in install/index.php in BlooFoxCMS 0.2.2 allows remote attackers to execute arbitrary PHP code via a URL in the contentphp parameter. NOTE: this issue has been disputed by a reliable third party, stating that contentphp is initialized before use...

CVE-2007-1148: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in install/index.php in LoveCMS 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the step parameter...

CVE-2006-6973: Undefined Security Weakness

Headstart Solutions DeskPRO does not require authentication for certain files and directories associated with administrative activities, which allows remote attackers to 1 reinstall the application via a direct request for install/index.php; 2 delete the database via a do=deletedatabase QUERYSTRI...