CVE-2006-4894: Undefined Security Weakness

Cross-site scripting XSS vulnerability in forms/lostpassword.php in iDevSpot NixieAffiliate 1.9 and earlier allows remote attackers to inject arbitrary web script or HTML via the error parameter...

NixieAffiliate 1.9 - lostpassword.php Cross-Site Scripting

NixieAffiliate 1.9 - lostpassword.php Cross-Site Scripting source: https://www.securityfocus.com/bid/20084/info NixieAffiliate is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this issue to have arbitrary script co...

CVE-2006-3607

Multiple cross-site scripting XSS vulnerabilities in Softbiz Banner Exchange Script aka Banner Exchange Network Script 1.0 allow remote attackers to inject arbitrary web script or HTML via 1 the city parameter in a insertmember.php, and 2 a PHPSESSID cookie in b lostpassword.php, c...

CVE-2006-1120: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in DCP-Portal 6.1.1 and earlier, with registerglobals enabled, allow remote attackers to inject arbitrary web script or HTML via the 1 itsurl parameter in the documents page and 2 url parameter in the sendwrite page of a index.php; 3 subject, and ...

CVE-2005-3365

Multiple SQL injection vulnerabilities in DCP-Portal 6 and earlier allow remote attackers to execute arbitrary SQL commands, possibly requiring encoded characters, via 1 the name parameter in register.php, 2 the email parameter in lostpassword.php, 3 the year parameter in calendar.php, and the 4...

CVE-2005-3365

Multiple SQL injection vulnerabilities in DCP-Portal 6 and earlier allow remote attackers to execute arbitrary SQL commands, possibly requiring encoded characters, via 1 the name parameter in register.php, 2 the email parameter in lostpassword.php, 3 the year parameter in calendar.php, and the 4...

CVE-2005-3365: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in DCP-Portal 6 and earlier allow remote attackers to execute arbitrary SQL commands, possibly requiring encoded characters, via 1 the name parameter in register.php, 2 the email parameter in lostpassword.php, 3 the year parameter in calendar.php, and the 4...