CVE-2006-6857: Undefined Security Weakness

Cross-site scripting XSS vulnerability in modules/credits/credits.php in Docebo LMS allows remote attackers to inject arbitrary web script or HTML via the lang parameter...

CVE-2006-6857

Cross-site scripting XSS vulnerability in modules/credits/credits.php in Docebo LMS allows remote attackers to inject arbitrary web script or HTML via the lang parameter...

CVE-2006-6019: Undefined Security Weakness

Cross-site scripting XSS vulnerability in extensions/googiespell/googlespellproxy.php in Bill Roberts Bloo 1.0 allows remote attackers to inject arbitrary web script or HTML via the lang parameter...

PT-2006-6666 · Bloo · Bloo

Name of the Vulnerable Software and Affected Versions: Bloo version 1.0 Description: A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the lang parameter in the extensions/googiespell/googlespell proxy.php file. Recommendations: For...

CVE-2006-5863: Undefined Security Weakness

PHP remote file inclusion vulnerability in inc/session.php for LetterIt 2 allows remote attackers to execute arbitrary PHP code via a URL in the lang parameter...

CVE-2006-5853

Cross-site scripting XSS vulnerability in logon.aspx in Immediacy CMS Immediacy .NET CMS 5.2 allows remote attackers to inject arbitrary web script or HTML via the lang parameter, which is returned to the client in a lang cookie...

CVE-2006-5853

Cross-site scripting XSS vulnerability in logon.aspx in Immediacy CMS Immediacy .NET CMS 5.2 allows remote attackers to inject arbitrary web script or HTML via the lang parameter, which is returned to the client in a lang cookie...

CVE-2006-5853: Undefined Security Weakness

Cross-site scripting XSS vulnerability in logon.aspx in Immediacy CMS Immediacy .NET CMS 5.2 allows remote attackers to inject arbitrary web script or HTML via the lang parameter, which is returned to the client in a lang cookie...

CVE-2006-5505: Undefined Security Weakness

Multiple PHP file inclusion vulnerabilities in 2BGal 3.0 allow remote attackers to execute arbitrary PHP code via the lang parameter to 1 admin/configuration.inc.php, 2 admin/creeralbum.inc.php, 3 admin/changepwd.php.inc, and unspecified other files. NOTE: the provenance of this information is...

CVE-2006-5389: Undefined Security Weakness

tools/tellhim.php in PHP-Wyana allows remote attackers to obtain sensitive information via an invalid lang parameter, which reveals the path in an error message...

CVE-2006-4913: Undefined Security Weakness

Directory traversal vulnerability in chat/getStartOptions.php in AlstraSoft E-friends 4.85 allows remote attackers to include arbitrary local files and possibly execute arbitrary code via a .. dot dot sequence and trailing null %00 byte in the lang parameter, as demonstrated by injecting PHP code...

CVE-2006-4753: Undefined Security Weakness

Directory traversal vulnerability in index.php in PHProg before 1.1 allows remote attackers to read arbitrary files via a .. dot dot in the lang parameter...

PT-2006-5528 · Phprog · Phprog

Name of the Vulnerable Software and Affected Versions: PHProg versions prior to 1.1 Description: The issue allows remote attackers to read arbitrary files via a .. dot dot in the lang parameter of the index.php file. This is a directory traversal vulnerability. Recommendations: For versions prior...

CVE-2006-3821

Multiple cross-site scripting XSS vulnerabilities in ATutor 1.5.3 allow remote attackers to inject arbitrary web script or HTML via the 1 lang parameter in a indexlist.php and 2 year, 3 month, and 4 day parameter in b registration.php...

pictureDis.txt

PictureDis Products "lang" Parameter File Inclusion Vulnerability ================================================= Input passed to the "lang" parameter in thumstbl.php, wpfiles.php, and wallpapr.php is not properly verified before being used to include files. This can be exploited to execute...

CVE-2006-3175: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in mcGuestbook 1.3 allow remote attackers to execute arbitrary PHP code via a URL in the lang parameter to 1 admin.php, 2 ecrire.php, and 3 lire.php. NOTE: it was later reported that the ecrire.php vector also affects 1.2. NOTE: this issue might ...

CVE-2006-3062

Cross-site scripting XSS vulnerability in index.php in myPHP Guestbook 2.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the lang parameter...

CVE-2006-3075: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in PictureDis Professional 1.33 Build 234 and earlier and PictureDis Photoalbum 4.82 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the lang parameter to files in photoalbum/ including 1 thumstbl.php, 2 wpfiles.php,...

CVE-2006-3062: Undefined Security Weakness

Cross-site scripting XSS vulnerability in index.php in myPHP Guestbook 2.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the lang parameter...

CVE-2006-2893: Undefined Security Weakness

index.php in GANTTy 1.0.3 allows remote attackers to obtain the full path of the web server via an invalid lang parameter in an authenticate action...