Virtual War File İnclusion

Virtual War File nclusion --------------------------------- Site:http://www.vwar.de/ Demo:http://www.vwar.de/demo/ --------------------------------------- File nclusion // get functions $vwarroot = "./"; require $vwarroot . "includes/functionscommon.php"; require $vwarroot...

CVE-2006-1641

Multiple SQL injection vulnerabilities in CzarNews 1.14 allow remote attackers to execute arbitrary SQL commands via the 1 usern or 2 passw parameters to a cnauth.php, 3 s parameter to b news.php, or 4 a parameter to c dpost.php...

CVE-2006-1640: Undefined Security Weakness

Cross-site scripting XSS vulnerability in news.php in CzarNews 1.14 allows remote attackers to inject arbitrary web script or HTML via the email parameter...

CVE-2006-1641: Undefined Security Weakness

Multiple SQL injection vulnerabilities in CzarNews 1.14 allow remote attackers to execute arbitrary SQL commands via the 1 usern or 2 passw parameters to a cnauth.php, 3 s parameter to b news.php, or 4 a parameter to c dpost.php...

CVE-2006-1575

QLnews 1.2 is affected by multiple XSS vulnerabilities in news.php. The issues allow remote attackers to inject arbitrary script/HTML via the autorx and newsx parameters due to inadequate input sanitization. This is documented across sources referencing CVE-2006-1575 (NVD) and eVuln materials not...

CVE-2006-1575

Multiple cross-site scripting XSS vulnerabilities in news.php in QLnews 1.2 allow remote attackers to inject arbitrary web script or HTML via the 1 autorx and 2 newsx parameters...

CVE-2006-1575: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in news.php in QLnews 1.2 allow remote attackers to inject arbitrary web script or HTML via the 1 autorx and 2 newsx parameters...

Sql injection

Multiple SQL injection vulnerabilities in vscripts aka Kuba Kunkiewicz VNews 1.2 allow remote attackers to execute arbitrary SQL commands via the 1 loginvar parameter in a admin/admin.php, and the 2 news and 3 nom parameters in b news.php...

CVE-2006-1543

Multiple SQL injection vulnerabilities in vscripts aka Kuba Kunkiewicz VNews 1.2 allow remote attackers to execute arbitrary SQL commands via the 1 loginvar parameter in a admin/admin.php, and the 2 news and 3 nom parameters in b news.php...

CVE-2006-1544

CVE-2006-1544 affects VNews 1.2 (vscripts) with multiple XSS flaws in news.php, exploitable via parameters autorkomentarza and tresckomentarza. The vulnerability allows remote attackers to inject arbitrary script/HTML. Exploitation: PoC/Exploit available per eVuln documentation. Affected software...

CVE-2006-1543: Undefined Security Weakness

Multiple SQL injection vulnerabilities in vscripts aka Kuba Kunkiewicz VNews 1.2 allow remote attackers to execute arbitrary SQL commands via the 1 loginvar parameter in a admin/admin.php, and the 2 news and 3 nom parameters in b news.php...

CVE-2006-1544: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in news.php in vscripts aka Kuba Kunkiewicz VNews 1.2 allow remote attackers to inject arbitrary web script or HTML via the 1 autorkomentarza and 2 tresckomentarza parameters...

[eVuln] NMDeluxe XSS & SQL Injection Vulnerabilities

New eVuln Advisory: NMDeluxe XSS & SQL Injection Vulnerabilities http://evuln.com/vulns/93/summary.html --------------------Summary---------------- eVuln ID: EV0093 CVE: CVE-2006-1107 CVE-2006-1108 Software: NMDeluxe Sowtware's Web Site: http://nmdeluxe.com/ Versions: 1.0.0 STABLE Critical Level:...

Sql injection

SQL injection vulnerability in news.php in NMDeluxe before 1.0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in news.php in NMDeluxe before 1.0.1 allows remote attackers to inject arbitrary web script or HTML via the nick parameter...

CVE-2006-1107

Cross-site scripting XSS vulnerability in news.php in NMDeluxe before 1.0.1 allows remote attackers to inject arbitrary web script or HTML via the nick parameter...

CVE-2006-1108

SQL injection vulnerability in news.php in NMDeluxe before 1.0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2006-1108

NMDeluxe is affected by a SQL injection in news.php via the id parameter, allowing remote attackers to execute arbitrary SQL commands. This vulnerability exists in versions before 1.0.1. Exploitation details are referenced in connected records (eVuln/DOC notes PoC). Remediation: upgrade to versio...

CVE-2006-1107

CVE-2006-1107 concerns NMDeluxe prior to 1.0.1, where the vulnerable script is news.php. The root cause is an XSS flaw in the nick parameter due to insufficient input sanitization, allowing remote attackers to inject arbitrary web script or HTML. Documents across multiple sources confirm the affe...

CVE-2006-1108: Undefined Security Weakness

SQL injection vulnerability in news.php in NMDeluxe before 1.0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter...