CVE-2006-6963: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Docebo LMS 3.0.3 allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALSwherelms parameter to 1 class.module/class.definition.php and 2 modules/scorm/scormutils.php. NOTE: this issue may overlap CVE-2006-2577...

Virtual Host Administrator Modules_Dir远程文件包含漏洞

Virtual Host Administrator是一款基于PHP的WEB应用程序。 Virtual Host Administrator不正确过滤用户提交的输入，远程攻击者可以利用漏洞以WEB权限执行任意命令。 问题是'main.php'脚本对用户提交的'MODULESDIR'参数缺少过滤，指定远程服务器上的文件作为包含参数，可导致以WEB权限执行任意命令。 Inter7 vhostadmin 0.1 目前没有解决方案提供： http://www.inter7.com/index.php?page=vhostadmin...

CVE-2007-0534

Multiple cross-site scripting XSS vulnerabilities in the 1 Project issue tracking 4.7.0 through 5.x before 20070123 and 2 Project 4.6.0 through 5.x before 20070123 modules for Drupal allow remote authenticated users to inject arbitrary web script or HTML via a certain "fields on project nodes" or...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the 1 Project issue tracking 4.7.0 through 5.x before 20070123 and 2 Project 4.6.0 through 5.x before 20070123 modules for Drupal allow remote authenticated users to inject arbitrary web script or HTML via a certain "fields on project nodes" or...

phpCOIN <= RC-1 (modules/mail/index.php) Remote File Include Vulnerability

phpCOIN = RC-1 modules/mail/index.php Remote File Include Vulnerability Script: phpCOIN Version: RC-1 URL: http://www.phpcoin.com/coinmodules/downloads/dload.php?id=1 Found by: Born To K!LL Bug in : modules/mail/index.php code : Include module functions file include...

vhostadmin 0.1 - MODULES_DIR Remote File Inclusion

vhostadmin 0.1 - MODULESDIR Remote File Inclusion | | \ | Dr Max Virus | / \ | | / / || \ / \ ------------------------------------------------------------------------------------------------------------------------ Script:vHostAdmin Affected Version:1.0 Risk:Highly Critical...

vhostadmin 0.1 (MODULES_DIR) Remote File Inclusion Vulnerability

Exploit for unknown platform in category web applications ================================================================ vhostadmin 0.1 MODULESDIR Remote File Inclusion Vulnerability ================================================================ | | \ | Dr Max Virus | / \ | | / / || \ / ...

vhostadmin 0.1 - 'MODULES_DIR' Remote File Inclusion

| | \ | Dr Max Virus | / \ | | / / || \ / \ ------------------------------------------------------------------------------------------------------------------------ Script:vHostAdmin Affected Version:1.0 Risk:Highly Critical...

CVE-2007-0372: Undefined Security Weakness

Multiple SQL injection vulnerabilities in Francisco Burzi PHP-Nuke 7.9 allow remote attackers to execute arbitrary SQL commands via 1 the active parameter in admin/modules/modules.php; the 2 adclass, 3 imageurl, 4 clickurl, 5 adcode, or 6 position parameter in modules/Advertising/admin/index.php;...

CVE-2006-6857: Undefined Security Weakness

Cross-site scripting XSS vulnerability in modules/credits/credits.php in Docebo LMS allows remote attackers to inject arbitrary web script or HTML via the lang parameter...

CVE-2006-6735: Exposure of Sensitive Information to an Unauthorized Actor

modules/viewcategory.php in Minh Nguyen Duong Obie Website Mini Web Shop 2.1.c allows remote attackers to obtain sensitive information via a request with an arbitrary catname parameter but no itemsdb parameter, which reveals the path in an error message. NOTE: CVE analysis suggests that this erro...

CVE-2006-6734: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in modules/viewcategory.php in Minh Nguyen Duong Obie Website Mini Web Shop 2.1.c allows remote attackers to inject arbitrary web script or HTML via the catname parameter...

CVE-2006-6534

Multiple cross-site scripting XSS vulnerabilities in osCommerce 3.0a3 allow remote attackers to inject arbitrary web script or HTML via the 1 set parameter to admin/modules.php, the 2 selectedbox parameter to definitiva/admin/customers.php, the 3 lID parameter to admin/languagesdefinitions.php, o...

GLSA-200612-04 : ModPlug: Multiple buffer overflows

The remote host is affected by the vulnerability described in GLSA-200612-04 ModPlug: Multiple buffer overflows Luigi Auriemma has reported various boundary errors in loadit.cpp and a boundary error in the 'CSoundFile::ReadSample' function in sndfile.cpp. Impact : A remote attacker can entice a...

CVE-2006-6370: Undefined Security Weakness

SQL injection vulnerability in forum/modules/gallery/post.php in Invision Gallery 2.0.7 allows remote attackers to cause a denial of service and possibly have other impacts, as demonstrated using a "SELECT BENCHMARK" statement in the img parameter in a doaddcomment operation in index.php...

CVE-2006-6200: Undefined Security Weakness

Multiple SQL injection vulnerabilities in the 1 ratearticle and 2 ratecomplete functions in modules/News/index.php in the News module in Francisco Burzi PHP-Nuke 7.9 and earlier, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the sid parameter...

CVE-2006-6202: Undefined Security Weakness

PHP remote file inclusion vulnerability in modules/NukeAI/util.php in the NukeAI 0.0.3 Beta module for PHP-Nuke, aka Program E is an AIML chatterbot, allows remote attackers to execute arbitrary PHP code via a URL in the AIbasedir parameter...

CVE-2006-5906: Undefined Security Weakness

PHP remote file inclusion vulnerability in modules/bannieres/bannieres.php in Jean-Christophe Ramos SCRIPT BANNIERES aka ban 0.1 and PLS-Bannieres 1.21 allows remote attackers to execute arbitrary PHP code via a URL in the chemin parameter. NOTE: the issue is disputed by other researchers, who...

CVE-2006-5907: Undefined Security Weakness

SQL injection vulnerability in modules/bannieres/bannieres.php in Jean-Christophe Ramos SCRIPT BANNIERES aka ban 0.1 and PLS-Bannieres 1.21 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2006-5803: Undefined Security Weakness

PHP remote file inclusion vulnerability in modules/mxsmartor/album.php in the mxBB Smartor Album module 1.02 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the modulerootpath parameter...