CVE-2009-2107

Multiple cross-site scripting XSS vulnerabilities in index.php in Webmedia Explorer webmex 5.09 and 5.10 allow remote attackers to inject arbitrary web script or HTML via event handlers such as onmouseover in the 1 search or 2 tag parameters; 3 arbitrary invalid parameter names that are not...

CVE-2009-2107

Multiple cross-site scripting XSS vulnerabilities in index.php in Webmedia Explorer webmex 5.09 and 5.10 allow remote attackers to inject arbitrary web script or HTML via event handlers such as onmouseover in the 1 search or 2 tag parameters; 3 arbitrary invalid parameter names that are not...

Code injection

Wysi Wiki Wyg 1.0 allows remote attackers to obtain system information via an invalid categup parameter to index.php, which calls the phpinfo function...

CVE-2008-5322

Wysi Wiki Wyg 1.0 allows remote attackers to obtain system information via an invalid categup parameter to index.php, which calls the phpinfo function...

Stack overflow

Unspecified vulnerability in the WebLogic Server Plugins for Apache component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, 8.1 SP6, 7.0 SP7, and 6.1 SP7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information wa...

tomcat examples XSS

Multiple cross-site scripting XSS vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 time parameter to cal2.jsp and 2 any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer...

CVE-2008-0784

graph.php in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k allows remote attackers to obtain the full path via an invalid localgraphid parameter and other unspecified vectors...

CVE-2003-1517

cart.pl in Dansie shopping cart allows remote attackers to obtain the installation path via an invalid db parameter, which leaks the path in an error message...

Design/Logic Flaw

SimpNews 2.41.03 allows remote attackers to obtain sensitive information via 1 an invalid lang parameter to admin/index.php; or a direct request to 2 admin/dbginfos.php, 3 admin/heading.php, or 4 evsearch.php; which reveals the path in various error messages...

Design/Logic Flaw

Calendarix 0.7.20070307 allows remote attackers to obtain sensitive information via 1 an invalid month parameter to calendar.php, 2 an invalid catview parameter to calweek.php in a week operation, 3 an invalid ycyear parameter to yearcal.php, or 4 a direct request to calfunctions.inc.php, which...

CVE-2007-3059

SendCard 3.3.0 allows remote attackers to obtain sensitive information via an invalid sclanguage parameter to sendcard.php, which reveals the path in an error message...

CVE-2007-3059

SendCard 3.3.0 allows remote attackers to obtain sensitive information via an invalid sclanguage parameter to sendcard.php, which reveals the path in an error message...

Deserialization of untrusted data

myEvent 1.6 allows remote attackers to obtain sensitive information via 1 a Log In action without a password to login.php, or an invalid 2 view or 3 monthno parameter to myevent.php, which reveals the path in various error messages...

CVE-2007-0259

CVE-2007-0259 affects Ezboxx Portal System Beta 0.7.6 and earlier. The vulnerability arises from an invalid cat parameter to the boxx/knowledgebase.asp page, causing an error message that reveals the server path. This exposes sensitive information to remote attackers. Exploitation details, affect...

CVE-2006-6460

Yourfreeworld.com Short Url & Url Tracker Script allows remote attackers to obtain sensitive information via an invalid id parameter to login.php, which leaks the path in an error message. NOTE: this issue might be resultant from CVE-2006-2509...

CVE-2006-6282

members.php in Vikingboard 0.1.2 allows remote attackers to trigger a forced SQL error via an invalid s parameter, a different vector than CVE-2006-4709. NOTE: might only be an exposure if displayerrors is enabled, but due to lack of details, even this is not clear...

CVE-2006-6273

spindex.php in Simple PHP Gallery 1.1 allows remote attackers to obtain sensitive information via an invalid dir parameter, which reveals the path in an error message...

CVE-2006-6282

members.php in Vikingboard 0.1.2 allows remote attackers to trigger a forced SQL error via an invalid s parameter, a different vector than CVE-2006-4709. NOTE: might only be an exposure if displayerrors is enabled, but due to lack of details, even this is not clear...

CVE-2006-6069

index.php in mAlbum 0.3 and earlier allows remote attackers to obtain the installation path via an invalid gal parameter...

CVE-2006-5389

The CVE-2006-5389 issue affects the PHP-Wyana component (tools/tellhim.php) where a malformed or invalid lang parameter causes an error message to disclose the server path, enabling information disclosure to remote attackers. The vulnerability is categorized as an information disclosure with part...