CVE-2006-5768

Multiple PHP remote file inclusion vulnerabilities in Cyberfolio 2.0 RC1 and earlier, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the av parameter to 1 msg/view.php, 2 msg/incmessage.php, 3 msg/incenvoi.php, and 4 admin/inclvoircompet.php...

NullSoft Winamp 5.3 - Ultravox-Max-Msg Heap Overflow Denial of Service (PoC)

/ Nullsoft Winamp include include include define SERVERPORT 80 unsigned char buff1header1= "HTTP/1.0 200 OK\x0D\x0A" "Server: Ultravox 3.0\x0D\x0A" "Content-Type: misc/ultravox\x0D\x0A" "Ultravox-SID: 13381\x0D\x0A" "Ultravox-Avg-Bitrate: 16000\x0D\x0A" "Ultravox-Max-Bitrate: 24000\x0D\x0A"...

NullSoft Winamp 5.3 - Ultravox-Max-Msg Heap Overflow Denial of Service (PoC)

NullSoft Winamp 5.3 - Ultravox-Max-Msg Heap Overflow Denial of Service PoC / Nullsoft Winamp include include include define SERVERPORT 80 unsigned char buff1header1= "HTTP/1.0 200 OK\x0D\x0A" "Server: Ultravox 3.0\x0D\x0A" "Content-Type: misc/ultravox\x0D\x0A" "Ultravox-SID: 13381\x0D\x0A"...

CVE-2006-5110: Undefined Security Weakness

Cross-site scripting XSS vulnerability in home.php in PHP Invoice 2.2 allows remote attackers to inject arbitrary web script or HTML via the msg parameter, a different vector than CVE-2006-5074. NOTE: the provenance of this information is unknown; the details are obtained from third party...

CVE-2006-4742: Undefined Security Weakness

Cross-site scripting XSS vulnerability in useradd.php in IDevSpot PhpLinkExchange 1.0 allows remote attackers to inject arbitrary web script or HTML via the msg parameter...

CVE-2006-4002

Drupal vulnerable component: the user.module in Drupal 4.6 (before 4.6.9) and 4.7 (before 4.7.3) allows remote XSS via the msg parameter. Impact: arbitrary script execution in a user’s browser (potential session-related risk). Root cause: insufficient input sanitising in user module. Affected ver...

CVE-2006-4002: Undefined Security Weakness

Cross-site scripting XSS vulnerability in user.module in Drupal 4.6 before 4.6.9, and 4.7 before 4.7.3, allows remote attackers to inject arbitrary web script or HTML via the msg parameter. NOTE: portions of these details are obtained from third party information...

CVE-2006-3189: Undefined Security Weakness

Cross-site scripting XSS vulnerability in administration/tblcontent/login1.php in HotPlug CMS 1.0 allows remote attackers to inject arbitrary web script or HTML via the msg parameter...

CVE-2006-3132

CVE-2006-3132 is an XSS vulnerability in QTOFileManager 1.0, specifically in the qtofm.php4 script, exploitable by injecting scripts via the msg parameter. The NVD entry lists impact to confidentiality and integrity (PARTIAL) with network attack vector and no authentication required. The connecte...

CVE-2006-3160: Undefined Security Weakness

Cross-site scripting XSS vulnerability in fm.php in ONEdotOH Simple File Manager SFM 0.24a and earlier allows remote attackers to inject arbitrary web script or HTML via the msg parameter...

CVE-2006-3132: Undefined Security Weakness

Cross-site scripting XSS vulnerability in qtofm.php4 in QTOFileManager 1.0 allows remote attackers to inject arbitrary web script or HTML via the msg parameter, as originally reported for index.php...

CVE-2006-3089: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in PhpMyFactures 1.0, and possibly 1.2 and earlier, allow remote attackers to inject arbitrary web script or HTML via the 1 prefixedossier parameter in a /inc/header.php; 2 msg parameter in b /remises/ajouterremise.php, c /tva/ajoutertva.php, d...

CVE-2005-2465: Undefined Security Weakness

Cross-site scripting XSS vulnerability in pm.php in PCXP/TOPPE CMS allows remote attackers to inject arbitrary web script or HTML via the msg variable...

CVE-2006-1660: Undefined Security Weakness

Cross-site scripting XSS vulnerability in imagedesc.php in Softbiz Image Gallery allows remote attackers to inject arbitrary web script or HTML via msg parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information...

CVE-2006-1580: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Bugzero 4.3.1 and other versions allow remote attackers to inject arbitrary web script or HTML via the 1 msg parameter in query.jsp and 2 entryId parameter in edit.jsp...

CVE-2006-1418: Undefined Security Weakness

Cross-site scripting XSS vulnerability in default.asp in Caloris Planitia E-School Management System 1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the msg parameter...

CVE-2006-1111: Undefined Security Weakness

Aztek Forum 4.0 allows remote attackers to obtain sensitive information via a "/" in the msg parameter to index.php, which reveals usernames and passwords in a MySQL error message, possibly due to a forced SQL error or SQL injection...

CVE-2006-1122: Undefined Security Weakness

Cross-site scripting XSS vulnerability in Default.asp in D2KBlog 1.0.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the msg parameter...

CVE-2005-4670: Undefined Security Weakness

Cross-site scripting XSS vulnerability in message.php in CityPost Automated Link Exchange LNKX allows remote attackers to inject arbitrary web script or HTML via the msg parameter...

CVE-2005-4218: Undefined Security Weakness

SQL injection vulnerability in forum.php in PHPWebThings 1.4 allows remote attackers to execute arbitrary SQL commands via the msg parameter, a different vulnerability than CVE-2005-3585...