Cross site scripting

Cross-site scripting XSS vulnerability in modules.php in NavBoard 16 2.6.0 allows remote attackers to inject arbitrary web script or HTML via the module parameter...

CVE-2008-5944

NavBoard 16 (2.6.0) has a cross-site scripting vulnerability in modules.php exploitable via the module parameter. Per NVD, CVE-2008-5944 enables remote script injection with network access, high complexity, no authentication, and partial integrity impact; no remediation details are provided in th...

CVE-2008-5944

Cross-site scripting XSS vulnerability in modules.php in NavBoard 16 2.6.0 allows remote attackers to inject arbitrary web script or HTML via the module parameter...

CVE-2008-5943

Multiple directory traversal vulnerabilities in NavBoard 16 2.6.0 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the module parameter to 1 adminmodules.php and 2 modules.php...

CVE-2008-5943

NavBoard 16 (2.6.0) contains multiple directory traversal vulnerabilities enabling remote inclusion/execution of local files via … in the module parameter to admin_modules.php or modules.php. CVSS v2 base score 7.5 (HIGH); network attack vector, low difficulty, no authentication required, partial...

CVE-2008-5039

Cross-site scripting XSS vulnerability in the League module for PHP-Nuke, possibly 2.4, allows remote attackers to inject arbitrary web script or HTML via the tid parameter in a team action to modules.php...

Cross site scripting

Cross-site scripting XSS vulnerability in the League module for PHP-Nuke, possibly 2.4, allows remote attackers to inject arbitrary web script or HTML via the tid parameter in a team action to modules.php...

CVE-2008-5039

Cross-site scripting XSS vulnerability in the League module for PHP-Nuke, possibly 2.4, allows remote attackers to inject arbitrary web script or HTML via the tid parameter in a team action to modules.php...

Gallery 'modules.php'本地文件包含漏洞

BUGTRAQ ID: 30608 CNCAN ID：CNCAN-2008081105 Gallery是一款基于PHP的图库管理程序。 Gallery不正确过滤用户提交的WEB输入，远程攻击者可以利用漏洞以WEB进程权限查看系统文件内容。 问题存在于'modules.php'脚本中，由于不正确过滤'phpEx'参数，构建包含'../'字符的数据作为URI参数，可绕过WEB ROOT限制以WEB进程权限查看系统文件内容。 Gallery Gallery 1.5.7 Gallery Gallery 1.6-alpha3 Gallery 1.5.8已经修正此漏洞：...

Gallery < 1.5.8 modules.php phpEx Parameter Traversal Local File Inclusion

Binary data 4619.prm...

Sql injection

SQL injection vulnerability in the Kleinanzeigen module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the lid parameter in a visit action to modules.php...

Sql injection

SQL injection vulnerability in the Book Catalog module 1.0 for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the catid parameter in a category action to modules.php...

phpnukeklein-sql.txt

Rbt-4 crew http://www.rbt-4.net Author : Lovebug ---------------------------- Remote Sql injection Php-Nuke module name Kleinanzeigen modules.php?name=Kleinanzeigen&aop=visit&lid=sql Exploit username :...

Sql injection

SQL injection vulnerability in the Trade module in Maxtrade AIO 1.3.23 allows remote attackers to execute arbitrary SQL commands via the categori parameter in a pocategorisell action to modules.php...

phpkuran-sql.txt

Author : Lovebug Italy Rbt-4 Crew www.rbt-4.net PHP-Nuke Module KuraniKerim sid SQL Injection Bug : modules.php?name=KuraniKerim&op=TurkceNukeComIslamiModullerDestekSitesi&sid = S Q L Exploit...

Cross site scripting

Cross-site scripting XSS vulnerability in index.php in the eWebsite eWeather Weather module for PHP-Nuke allows remote attackers to inject arbitrary web script or HTML via the chart parameter to modules.php...

CVE-2008-1348

Cross-site scripting XSS vulnerability in index.php in the eWebsite eWeather Weather module for PHP-Nuke allows remote attackers to inject arbitrary web script or HTML via the chart parameter to modules.php...

Sql injection

SQL injection vulnerability in the ZClassifieds module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the cat parameter to modules.php...

phpnukezclass-sql.txt

----- RBT-4 crew Lovebug Italy -------- Author : Lovebug Script : PHP-Nuke Module ZClassifieds cat SQL Injection Bug : modules.php?name=ZClassifieds&cat= S Q L Exploit : -9999999//union//select//pwd,aid//from//nukeauthors/where%20admin1/ Original Advisory:...

PT-2008-2906 · Php Nuke Team · Php-Nuke

Name of the Vulnerable Software and Affected Versions: PHP-Nuke ZClassifieds module affected versions not specified Description: The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the cat parameter in the modules.php endpoint. Recommendations: For...