CVE-2012-2937

Multiple SQL injection vulnerabilities in Pligg CMS before 1.2.2 allow remote attackers to execute arbitrary SQL commands via the 1 list parameter in a move action to admin/adminindex.php, 2 display parameter in a minimize action to admin/adminindex.php, 3 enabled parameter to admin/adminusers.ph...

CVE-2012-2937: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Pligg CMS before 1.2.2 allow remote attackers to execute arbitrary SQL commands via the 1 list parameter in a move action to admin/adminindex.php, 2 display parameter in a minimize action to admin/adminindex.php, 3 enabled parameter to admin/adminusers.ph...

Pligg CMS 1.2.1 SQL注入漏洞

Bugtraq ID: 53625 Pligg CMS是一款内容管理系统。 Pligg CMS包含的admin/adminindex.php，admin/adminusers.php，module.php脚本不正确过滤用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，可获得数据库信息或控制应用系统。 0 Pligg CMS 1.2.1 厂商解决方案 Pligg CMS 1.2.2已经修复此漏洞，建议用户下载使用： http://forums.pligg.com/downloads.php?do=file&id=15...

PhpGedView module.php pgvaction Parameter Traversal Local File Inclusion

The web server hosts PhpGedView, a web-based real estate listing management application written in PHP. The version of PhpGedView installed on the remote host fails to sanitize user input to the 'pgvaction' parameter of the 'module.php' script before using it to include PHP code. Regardless of...

CVE-2011-0405: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in module.php in PhpGedView 4.2.3 and possibly other versions, when magicquotesgpc is disabled, allows remote attackers to read arbitrary files via directory traversal sequences in the pgvaction parameter...

CVE-2010-4634

osTicket 1.6 is affected by a directory traversal vulnerability. The issue allows remote attackers to read arbitrary files by supplying .. sequences in the file parameter to module.php, a vulnerability described across CVE-2010-4634. The description notes this is a separate vector from CVE-2005-1...

CVE-2010-4634: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in osTicket 1.6 allows remote attackers to read arbitrary files via a .. dot dot in the file parameter to module.php, a different vector than CVE-2005-1439. NOTE: this issue has been disputed by a reliable third party...

PT-2010-5598

Name of the Vulnerable Software and Affected Versions osTicket version 1.6 Description A directory traversal issue allows remote attackers to read arbitrary files by using a .. dot dot in the file parameter to "module.php". This issue has been disputed by a reliable third party. Recommendations F...

Cross site scripting

Cross-site scripting XSS vulnerability in module.php in PHPFABER CMS, possibly 1.3.36, allows remote attackers to inject arbitrary web script or HTML via the mod parameter...

CVE-2009-4382

CVE-2009-4382 affects phpFaber CMS, likely in module.php, where user-supplied mod parameter enables cross-site scripting (XSS). Public records indicate PHPFaber CMS 1.3.36 is vulnerable; root cause is insufficient sanitization of input, allowing arbitrary script/HTML injection. The vulnerability ...

CVE-2009-4382: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in module.php in PHPFABER CMS, possibly 1.3.36, allows remote attackers to inject arbitrary web script or HTML via the mod parameter...

Directory traversal

module.php in ezContents 2.0.3 allows remote attackers to bypass the directory traversal protection mechanism to include and execute arbitrary local files via "....//" doubled dot dot slash sequences in the link parameter, which is not properly filtered using the strreplace function...

CVE-2008-7055

CVE-2008-7055 affects ezContents 2.0.3: module.php allows remote attackers to bypass directory traversal protections and include/execute arbitrary local files via "....//" sequences in the link parameter. The flaw arises from improper filtering by str_replace. Evidence from NVD/NVD-linked entries...

CVE-2008-7055

module.php in ezContents 2.0.3 allows remote attackers to bypass the directory traversal protection mechanism to include and execute arbitrary local files via "....//" doubled dot dot slash sequences in the link parameter, which is not properly filtered using the strreplace function...

CVE-2008-7055: Improper Limitation of a Pathname to a Restricted Directory

module.php in ezContents 2.0.3 allows remote attackers to bypass the directory traversal protection mechanism to include and execute arbitrary local files via "....//" doubled dot dot slash sequences in the link parameter, which is not properly filtered using the strreplace function...

Pigyard Art Gallery Multiple SQL Injection

Aria-Security Team, http://Aria-Security.net ------------------------------- Shout Outs: AurA, imm02tal, iM4N, Kinglet, Vendor: Pigyard Art Gallery Multiple SQL Injection This is a completation of the original advisory reported by ZoRLu @ Milw0rm http://www.milw0rm.com/exploits/5181 Original Link...

CVE-2007-4210

CVE-2007-4210 affects LANAI (la-nai) CMS 1.2.14. The issue consists of multiple SQL injection vulnerabilities in module.php, allowing remote attackers to execute arbitrary SQL commands via three parameters: (1) mid in the FAQ Modules (faqviewgroup action), (2) cid in EZSHOPPINGCART Modules, and (...

CVE-2007-4210: Undefined Security Weakness

Multiple SQL injection vulnerabilities in module.php in LANAI la-nai CMS 1.2.14 allow remote attackers to execute arbitrary SQL commands via 1 the mid parameter in an faqviewgroup action in the FAQ Modules, 2 the cid parameter in the EZSHOPINGCART Modules, or 3 the gid parameter in a view action ...

Digital Eye Gallery 1.1 Beta (module.php menu) Remote File Include Vulnerabilities

Digital Eye Gallery 1.1 Beta module.php menu Remote File Include Vulnerabilities script : http://mamboxchange.com/frs/download.php/7469/digitaleyecms.1.1BETA.tar.gz file : /module.php Found by & Contact : Cold z3ro , [email protected] , http://hack-teach.com/ , Team Hell Crew requireonce $men...

Digital Eye Gallery Module.PHP远程文件包含漏洞

Digital Eye Gallery是一款基于PHP的WEB应用程序。 Digital Eye Gallery不正确过滤用户提交的输入，远程攻击者可以利用漏洞以WEB权限执行任意命令。 问题是'Module.PHP'脚本对用户提交的'menu'参数缺少过滤，指定远程服务器上的文件作为包含参数，可导致以WEB权限执行任意命令。 Digital Eye Gallery Digital Eye Gallery 1.1 Beta 目前没有解决方案提供： http://mamboxchange.com/projects/digitaleye/...