LinPHA 1.3.1 - new_images.php Blind SQL Injection

LinPHA 1.3.1 - newimages.php Blind SQL Injection order = $REQUEST'order'; 188. 189. if$defaultorder != $REQUEST'order' 190. 191. $this-linkaddress .= '&order='.$REQUEST'order'; 192. 193. 194. else 195. 196. $this-order = $defaultorder; 197. 198. 199. 200. // 201. // set sql query string 202. //...

CVE-2006-1923

Multiple cross-site scripting XSS vulnerabilities in LinPHA before 1.1.1 allow remote attackers to inject arbitrary web script or HTML via 1 RSS/RSS.php and 2 possibly other vectors...

CVE-2006-1924

SQL injection vulnerability in functions/dbapi.php in LinPHA 1.1.1 allows remote attackers to execute arbitrary SQL commands via unknown vectors...

Sql injection

SQL injection vulnerability in functions/dbapi.php in LinPHA 1.1.1 allows remote attackers to execute arbitrary SQL commands via unknown vectors...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in LinPHA before 1.1.1 allow remote attackers to inject arbitrary web script or HTML via 1 RSS/RSS.php and 2 possibly other vectors...

CVE-2006-1924

SQL injection vulnerability in functions/dbapi.php in LinPHA 1.1.1 allows remote attackers to execute arbitrary SQL commands via unknown vectors...

CVE-2006-1924

CVE-2006-1924 concerns LinPHA 1.1.1 where SQL injection is possible through the functions/db_api.php component, allowing remote attackers to execute arbitrary SQL commands via unknown vectors. The record consistently states this vulnerability without detailing a fix in the provided documents; no ...

CVE-2006-1923

CVE-2006-1923 affects LinPHA prior to 1.1.1. The vulnerability is described as multiple cross-site scripting (XSS) flaws that allow remote attackers to inject arbitrary web script or HTML via RSS/RSS.php and possibly other vectors. The available documents do not provide explicit exploit details b...

CVE-2006-1923

Multiple cross-site scripting XSS vulnerabilities in LinPHA before 1.1.1 allow remote attackers to inject arbitrary web script or HTML via 1 RSS/RSS.php and 2 possibly other vectors...

CVE-2006-1848

Multiple cross-site scripting XSS vulnerabilities in statsview.php in LinPHA 1.1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 datefrom, 2 dateto, and 3 date parameter...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in statsview.php in LinPHA 1.1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 datefrom, 2 dateto, and 3 date parameter...

CVE-2006-1848

LinPHA 1.1.0 is vulnerable to multiple cross-site scripting (XSS) in stats_view.php via the date_from, date_to, and date parameters due to insufficient input sanitization. Remote attackers may inject arbitrary script in the victim’s browser context. Exploit details are evidenced by sources such a...

Linpha 1.1.0 - XSS Vulnerabilities

Linpha 1.1.0 - XSS Vulnerabilities -------------------------------------------------------- Software: Linpha Version: 1.1.0 Type: Cross Site Scripting Vulnerability Date: Mon Apr 17 22:59:39 CEST 2006 Vendor: The LinPHA developers Page: http://linpha.sourceforge.net/ Risc: Low credits:...

LinPHA 1.1 - Multiple Cross-Site Scripting Vulnerabilities

LinPHA 1.1 Multiple Cross-Site Scripting Vulnerabilities. CVE-2006-1848. Webapps exploit for php platform source: http://www.securityfocus.com/bid/17581/info LinPHA is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. An...

CVE-2006-0713

Directory traversal vulnerability in LinPHA 1.0 allows remote attackers to include arbitrary files via .. dot dot sequences in the 1 lang parameter in docs/index.php and the language parameter in 2 install/install.php, 3 install/secstageinstall.php, 4 install/thirdstageinstall.php, and 5...

Directory traversal

Directory traversal vulnerability in LinPHA 1.0 allows remote attackers to include arbitrary files via .. dot dot sequences in the 1 lang parameter in docs/index.php and the language parameter in 2 install/install.php, 3 install/secstageinstall.php, 4 install/thirdstageinstall.php, and 5...

CVE-2006-0713

Directory traversal vulnerability in LinPHA 1.0 allows remote attackers to include arbitrary files via .. dot dot sequences in the 1 lang parameter in docs/index.php and the language parameter in 2 install/install.php, 3 install/secstageinstall.php, 4 install/thirdstageinstall.php, and 5...

CVE-2006-0713

Affected software/impact (supported): LinPHA 1.0 contains a directory traversal flaw that allows remote attackers to include arbitrary files via .. sequences in specific language parameters (docs/index.php and several install.php variants). The underlying issue is the ability to influence file pa...

linpha_10_local.txt

------------- Linpha = 1.0 multiple arbitrary local inclusion ----------------- software: site: http://linpha.sourceforge.net/nuke/ description: " LinPHA is an easy to use, multilingual, flexible photo / image archive / album / gallery written in PHP. It uses a SQL database to store information...

LinPHA <= 1.0 Multiple Vulnerabilities

The remote host is running LinPHA, a web photo gallery application written in PHP. The installed version of LinPHA suffers from a number of flaws, several of which could allow an unauthenticated attacker to view arbitrary files or to execute arbitrary PHP code on the remote host, subject to the...