CVE-2026-34607: Improper Limitation of a Pathname to a Restricted Directory

Emlog is an open source website building system. In versions 2.6.2 and prior, a path traversal vulnerability exists in the emUnZip function include/lib/common.php:793. When extracting ZIP archives plugin/template uploads, backup imports, the function calls $zip-extractTo$path without sanitizing Z...

CVE-2024-12845: Improper Neutralization of Input During Web Page Generation

A vulnerability classified as problematic was found in Emlog Pro up to 2.4.1. Affected by this vulnerability is an unknown functionality in the library /include/lib/common.php. The manipulation of the argument msg leads to cross site scripting. The attack can be launched remotely. The exploit has...

Geeklog SEC_authenticate()函数SQL注入漏洞

BUGTRAQ ID: 34456 Geeklog是一个免费的、开放源码的Web应用程序。它可以使用户创建一个虚拟的社区，可以管理用户，张贴文章等。Geeklog采用PHP实现，以MySQL为后台数据库。 Geeklog的index.php模块中的SECauthenticate函数没有正确的验证用户所提交的PHPAUTHUSER和 REMOTEUSER变量参数，远程攻击者可以通过提交恶意查询请求执行SQL注入攻击。以下是/publichtml/webservices /atom/index.php文件中34-53行的有漏洞代码段： ... requireonce...

CVE-2006-3306

CVE-2006-3306 affects Project EROS bbsengine (lib/common.php, preparestring) with an XSS flaw. The vulnerability is in the preparestring function and could allow remote attackers to inject arbitrary web script or HTML; affected versions include before 20060501-0142-jam and possibly earlier since ...

CVE-2006-3306: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the preparestring function in lib/common.php in Project EROS bbsengine before 20060501-0142-jam, and possibly earlier versions dating back to 2006-02-23, might allow remote attackers to inject arbitrary web script or HTML via unknown vectors...

CVE-2006-0824

Multiple unspecified vulnerabilities in lib-common.php in Geeklog 1.4.0 before 1.4.0sr1 and 1.3.11 before 1.3.11sr4 allow remote attackers to include arbitrary local files and execute arbitrary code via 1 absolute paths in unspecified parameters and 2 the language cookie, as demonstrated for code...

CVE-2006-0824

CVE-2006-0824 affects Geeklog: lib-common.php in Geeklog 1.4.0 before 1.4.0sr1 and 1.3.11 before 1.3.11sr4 allows remote attackers to include arbitrary local files and execute code via absolute paths in unspecified parameters and via the language cookie (demonstrated for code execution using erro...

CVE-2006-0824: Undefined Security Weakness

Multiple unspecified vulnerabilities in lib-common.php in Geeklog 1.4.0 before 1.4.0sr1 and 1.3.11 before 1.3.11sr4 allow remote attackers to include arbitrary local files and execute arbitrary code via 1 absolute paths in unspecified parameters and 2 the language cookie, as demonstrated for code...