MAXdev MD-Pro 1.0.76 - 'user.php' Cross-Site Scripting

MAXdev MD-Pro is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacke...

[SA22050] MAXdev MD-Pro Cross-Site Scripting Vulnerability

TITLE: MAXdev MD-Pro Cross-Site Scripting Vulnerability SECUNIA ADVISORY ID: SA22050 VERIFY ADVISORY: http://secunia.com/advisories/22050/ CRITICAL: Less critical IMPACT: Cross Site Scripting WHERE: From remote SOFTWARE: MAXdev MD-Pro 1.x http://secunia.com/product/5663/ DESCRIPTION: A...

[SA19563] MAXdev MD-Pro ADOdb "server.php" Insecure Test Script Security Issue

TITLE: MAXdev MD-Pro ADOdb "server.php" Insecure Test Script Security Issue SECUNIA ADVISORY ID: SA19563 VERIFY ADVISORY: http://secunia.com/advisories/19563/ CRITICAL: Moderately critical IMPACT: Security Bypass, System access WHERE: From remote SOFTWARE: MAXdev MD-Pro 1.x...

[SA19578] MAXdev MD-Pro "topicid" SQL Injection Vulnerability

TITLE: MAXdev MD-Pro "topicid" SQL Injection Vulnerability SECUNIA ADVISORY ID: SA19578 VERIFY ADVISORY: http://secunia.com/advisories/19578/ CRITICAL: Moderately critical IMPACT: Manipulation of data, Exposure of system information WHERE: From remote SOFTWARE: MAXdev MD-Pro 1.x...

Design/Logic Flaw

Dynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP before 4.70, as used in multiple products including 1 Mantis, 2 PostNuke, 3 Moodle, 4 Cacti, 5 Xaraya, 6 PhpOpenChat, possibly 7 MAXdev MD-Pro, and 8 Simplog, allows remote attackers to execute arbitrary PHP...

CVE-2006-0147

Dynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP before 4.70, as used in multiple products including 1 Mantis, 2 PostNuke, 3 Moodle, 4 Cacti, 5 Xaraya, 6 PhpOpenChat, possibly 7 MAXdev MD-Pro, and 8 Simplog, allows remote attackers to execute arbitrary PHP...

CVE-2006-0147

Dynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP before 4.70, as used in multiple products including 1 Mantis, 2 PostNuke, 3 Moodle, 4 Cacti, 5 Xaraya, 6 PhpOpenChat, possibly 7 MAXdev MD-Pro, and 8 Simplog, allows remote attackers to execute arbitrary PHP...

PT-2006-1226 · Adodb +9 · Adodb +9

Name of the Vulnerable Software and Affected Versions: ADODB versions prior to 4.70 Mantis versions prior to 1.1.0a PostNuke versions prior to 0.764 Moodle versions prior to 1.5.3 Cacti versions prior to 0.8.6i Xaraya versions prior to 0.98 PHPOpenChat versions prior to 1.0.6 MAXdev MD-Pro versio...

CVE-2005-2885

The Downloads page in MAXdev MD-Pro 1.0.73, and possibly earlier versions, uses an incomplete blacklist to check for dangerous file extensions, which could allow remote attackers to bypass file extension checks and execute arbitrary commands by uploading a file with a different extension, as...

CVE-2005-2887

MAXdev MD-Pro 1.0.73, and possibly earlier versions, allows remote attackers to obtain sensitive information via a direct request to 1 wiki.php, 2 AutoTheme directory, 3 Blocks directory, 4 admin.php, 5 pnadmin.php, or 6 Topics directory, which reveal the path in an error message...

CVE-2005-2886

Multiple cross-site scripting XSS vulnerabilities in MAXdev MD-Pro 1.0.73, and possibly earlier versions, allow remote attackers to inject arbitrary web script or HTML via 1 the print parameter to the print module, the sitename parameter to 2 bbsmilies or 3 bbcoderef module, or 4 the hlpfile...

CVE-2005-2886

Multiple cross-site scripting XSS vulnerabilities in MAXdev MD-Pro 1.0.73, and possibly earlier versions, allow remote attackers to inject arbitrary web script or HTML via 1 the print parameter to the print module, the sitename parameter to 2 bbsmilies or 3 bbcoderef module, or 4 the hlpfile...

CVE-2005-2886

CVE-2005-2886 affects MAXdev MD-Pro 1.0.73 (and possibly earlier) with multiple XSS vulnerabilities. The issue allows remote attackers to inject arbitrary web script or HTML via: (1) the print parameter to the print module, (2) the sitename parameter to the bb_smilies module, (3) the sitename par...

CVE-2005-2887

MAXdev MD-Pro 1.0.73 (and possibly earlier) is vulnerable to information disclosure via direct requests to wiki.php, AutoTheme, Blocks, admin.php, pnadmin.php, or Topics directories, where an error message reveals the path. No remediation details are provided in the supplied documents.

CVE-2005-2885

The CVE-2005-2885 issue affects MAXdev MD-Pro 1.0.73 (and possibly earlier) where the Downloads page uses an incomplete blacklist for dangerous file extensions, enabling remote attackers to bypass extension checks and execute arbitrary commands by uploading a file with a non-listed extension (dem...

CVE-2005-2885

The Downloads page in MAXdev MD-Pro 1.0.73, and possibly earlier versions, uses an incomplete blacklist to check for dangerous file extensions, which could allow remote attackers to bypass file extension checks and execute arbitrary commands by uploading a file with a different extension, as...

CVE-2005-2887

MAXdev MD-Pro 1.0.73, and possibly earlier versions, allows remote attackers to obtain sensitive information via a direct request to 1 wiki.php, 2 AutoTheme directory, 3 Blocks directory, 4 admin.php, 5 pnadmin.php, or 6 Topics directory, which reveal the path in an error message...

CVE-2005-2840

Multiple unknown vulnerabilities in MAXdev MD-Pro 1.0.72 and earlier have unknown impact and unspecified attack vectors, in one or more of the 1 Download, 2 Search, 3 Web links, 4 Blocks, 5 Messages, 6 News, 7 Comments, 8 Settings, 9 Stats or 10 subjects modules...

CVE-2005-2839

Multiple cross-site scripting XSS vulnerabilities in MAXdev MD-Pro 1.0.72 allow remote attackers to inject arbitrary web script or HTML via 1 dl-search.php or 2 wl-search.php...

CVE-2005-2840

Multiple unknown vulnerabilities in MAXdev MD-Pro 1.0.72 and earlier have unknown impact and unspecified attack vectors, in one or more of the 1 Download, 2 Search, 3 Web links, 4 Blocks, 5 Messages, 6 News, 7 Comments, 8 Settings, 9 Stats or 10 subjects modules...