228 matches found
Cross site scripting
Cross-site scripting XSS vulnerability in the League module for PHP-Nuke, possibly 2.4, allows remote attackers to inject arbitrary web script or HTML via the tid parameter in a team action to modules.php...
CVE-2008-5039
Cross-site scripting XSS vulnerability in the League module for PHP-Nuke, possibly 2.4, allows remote attackers to inject arbitrary web script or HTML via the tid parameter in a team action to modules.php...
CVE-2008-5039: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the League module for PHP-Nuke, possibly 2.4, allows remote attackers to inject arbitrary web script or HTML via the tid parameter in a team action to modules.php...
CVE-2008-3600: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in contrib/phpBB2/modules.php in Gallery 1.5.7 and 1.6-alpha3, when registerglobals is enabled, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the phpEx parameter within a modload action...
Gallery 'modules.php'本地文件包含漏洞
BUGTRAQ ID: 30608 CNCAN ID：CNCAN-2008081105 Gallery是一款基于PHP的图库管理程序。 Gallery不正确过滤用户提交的WEB输入，远程攻击者可以利用漏洞以WEB进程权限查看系统文件内容。 问题存在于'modules.php'脚本中，由于不正确过滤'phpEx'参数，构建包含'../'字符的数据作为URI参数，可绕过WEB ROOT限制以WEB进程权限查看系统文件内容。 Gallery Gallery 1.5.7 Gallery Gallery 1.6-alpha3 Gallery 1.5.8已经修正此漏洞：...
Gallery < 1.5.8 modules.php phpEx Parameter Traversal Local File Inclusion
Binary data 4619.prm...
Sql injection
SQL injection vulnerability in the Book Catalog module 1.0 for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the catid parameter in a category action to modules.php...
Sql injection
SQL injection vulnerability in the Kleinanzeigen module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the lid parameter in a visit action to modules.php...
CVE-2008-3513: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in the Book Catalog module 1.0 for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the catid parameter in a category action to modules.php...
CVE-2008-3512: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in the Kleinanzeigen module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the lid parameter in a visit action to modules.php...
phpnukeklein-sql.txt
Rbt-4 crew http://www.rbt-4.net Author : Lovebug ---------------------------- Remote Sql injection Php-Nuke module name Kleinanzeigen modules.php?name=Kleinanzeigen&aop=visit&lid=sql Exploit username :...
Sql injection
SQL injection vulnerability in the Trade module in Maxtrade AIO 1.3.23 allows remote attackers to execute arbitrary SQL commands via the categori parameter in a pocategorisell action to modules.php...
phpkuran-sql.txt
Author : Lovebug Italy Rbt-4 Crew www.rbt-4.net PHP-Nuke Module KuraniKerim sid SQL Injection Bug : modules.php?name=KuraniKerim&op=TurkceNukeComIslamiModullerDestekSitesi&sid = S Q L Exploit...
CVE-2008-1348
Cross-site scripting XSS vulnerability in index.php in the eWebsite eWeather Weather module for PHP-Nuke allows remote attackers to inject arbitrary web script or HTML via the chart parameter to modules.php...
Cross site scripting
Cross-site scripting XSS vulnerability in index.php in the eWebsite eWeather Weather module for PHP-Nuke allows remote attackers to inject arbitrary web script or HTML via the chart parameter to modules.php...
CVE-2008-1348: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in index.php in the eWebsite eWeather Weather module for PHP-Nuke allows remote attackers to inject arbitrary web script or HTML via the chart parameter to modules.php...
Sql injection
SQL injection vulnerability in the ZClassifieds module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the cat parameter to modules.php...
phpnukezclass-sql.txt
----- RBT-4 crew Lovebug Italy -------- Author : Lovebug Script : PHP-Nuke Module ZClassifieds cat SQL Injection Bug : modules.php?name=ZClassifieds&cat= S Q L Exploit : -9999999//union//select//pwd,aid//from//nukeauthors/where%20admin1/ Original Advisory:...
PT-2008-2906 · Php Nuke Team · Php-Nuke
Name of the Vulnerable Software and Affected Versions: PHP-Nuke ZClassifieds module affected versions not specified Description: The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the cat parameter in the modules.php endpoint. Recommendations: For...