Information disclosure

wp-login.php in WordPress 2.0.5 and earlier displays different error messages if a user exists or not, which allows remote attackers to obtain sensitive information and facilitates brute force attacks...

CVE-2007-0109: Undefined Security Weakness

wp-login.php in WordPress 2.0.5 and earlier displays different error messages if a user exists or not, which allows remote attackers to obtain sensitive information and facilitates brute force attacks...

CVE-2007-0109

wp-login.php in WordPress 2.0.5 and earlier displays different error messages if a user exists or not, which allows remote attackers to obtain sensitive information and facilitates brute force attacks...

CVE-2006-6790: Undefined Security Weakness

Direct static code injection vulnerability in chat/login.php in Ultimate PHP Board UPB 2.0b1 and earlier allows remote attackers to inject arbitrary PHP code via the username parameter, which is injected into chat/text.php...

CVE-2006-6790

Summary: CVE-2006-6790 affects Ultimate PHP Board (UPB) 2.0b1 and earlier. The vulnerability is in chat/login.php where the username parameter is written to chat/text.php without proper sanitization, allowing an attacker to inject arbitrary PHP code that can be executed with the web server user p...

Ultimate PHP Board 2.0b1 - '/chat/login.php' Code Execution

!/usr/bin/perl +------------------------------------------------------------------------------------------- + Ultimate PHP Board +------------------------------------------------------------------------------------------- + Details: + Ultimate PHP Board chat/login.php does not sanatize the...

CVE-2006-6460

YourFreeWorld.com Short Url & Url Tracker Script is affected by CVE-2006-6460: an invalid id parameter to login.php leaks the internal path via an error message, exposing sensitive information. The entry notes a possible relation to CVE-2006-2509. Connected sources confirm the affected product an...

CVE-2006-6460: Undefined Security Weakness

Yourfreeworld.com Short Url & Url Tracker Script allows remote attackers to obtain sensitive information via an invalid id parameter to login.php, which leaks the path in an error message. NOTE: this issue might be resultant from CVE-2006-2509...

Spaminator <= 1.7 (page) Remote File Include Vulnerability

No description provided by source. Spaminator 1.7. $page Remote File Include CreW: ToXiC BuG Found By Drago84 SourcE CodE: http://freshmeat.net/redir/spaminator/16281/urltgz/spaminator-1.7.tar.gz Page Affect is: /src/Login.php Problem is include "$page.php"; Path : Declare $page ExpL:...

phpCC 4.2 beta (base_dir) Remote File Inclusion Vulnerability

No description provided by source. SolpotCrew Community phpCC - Beta 4.2 basedir Remote File Inclusion Download file : http://www.phpcc.at/downloadfile1.html Bug Found By :Solpot a.k.a k. Hasibuan 06-08-2006 contact: [email protected] Website : http://www.solpotcrew.org/adv/solpot-adv-05.tx...

CVE-2006-6033: Undefined Security Weakness

Multiple directory traversal vulnerabilities in Simple PHP Blog SPHPBlog, probably 0.4.8, allow remote attackers to read arbitrary files and possibly include arbitrary PHP code via a .. dot dot sequence in the blogtheme parameter in 1 index.php, 2 addcgi.php, 3 addlink.php, 4 login.php, 5...

sphpblog08-rfi.txt

""""""""""""""""""""""""""""""""""""""""""""""" """ :: :: ::::: :::: """ """ :: :: :: : :: """ """ :::: :: :: ::::: ::::: :::: """ """ :: :: ::: ::: :: :: :: :: :: """ """ :: :: :: : : ::::: :: :: :::: """ """ """ """"""""""""""""""""""""""""""""""""""""""""""" Xmor$ DigitaL Hacking TeaM Sphpblog...

phpwcms <= 1.2.6 (Cookie: wcs_user_lang) Local File Include Exploit

Exploit for unknown platform in category web applications =================================================================== phpwcms = 1.2.6 Cookie: wcsuserlang Local File Include Exploit =================================================================== ? print ' ::::::::: :::::::::: ::: :::...

CVE-2006-5662: Undefined Security Weakness

SQL injection vulnerability in easy notesManager eNM 0.0.1 allows remote attackers to execute arbitrary SQL commands via 1 the username parameter in login.php and 2 a search on the "search page."...

Fully Modded phpBB <= 2021.4.40 Multiple File Include Vulnerabilities

Exploit for unknown platform in category web applications ===================================================================== Fully Modded phpBB = 2021.4.40 Multiple File Include Vulnerabilities ===================================================================== Fully Modded phpBB 2 Remote Fi...

CVE-2006-5228

Multiple SQL injection vulnerabilities in the Google Gadget login.php gadget/login.php in Rob Hensley ackerTodo 4.2 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 uplogin, 2 uppass, or 3 upnumtasks parameters...

CVE-2006-5228: Undefined Security Weakness

Multiple SQL injection vulnerabilities in the Google Gadget login.php gadget/login.php in Rob Hensley ackerTodo 4.2 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 uplogin, 2 uppass, or 3 upnumtasks parameters...

CVE-2006-5119: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Zen Cart 1.3.5 allow remote attackers to inject arbitrary web script or HTML via the 1 adminname or 2 adminpass parameter in a admin/login.php, or the 3 adminemail parameter in b admin/passwordforgotten.php...

CVE-2006-5059

Multiple cross-site scripting XSS vulnerabilities in WWWthreads 5.4.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the Cat parameter to 1 dosearch.php, 2 postlist.php, 3 showmembers.php, 4 faqenglish.php, 5 online.php, 6 login.php, 7 newuser.php, 8 wwwthreads.php,...

CVE-2006-5060

The CVE-2006-5060 entry concerns a cross-site scripting (XSS) vulnerability in Jamroom 3.0.16 (and possibly earlier) within login.php, exploitable via the forgot parameter in the forgot mode. The NVD details a CVSSv2 base score of 5.1 (Medium) with network attack vector, high complexity, no authe...