CVE-2007-4861

SAXON 5.4 is affected by multiple path disclosure flaws when display_errors is enabled. Exploitation vectors include direct requests to news.php, improper handling of newsid in admin/edit-item.php, and other scripts under admin/, rss/, and the installation root, which reveal server paths in error...

CVE-2007-4861

SAXON 5.4, with displayerrors enabled, allows remote attackers to obtain sensitive information via 1 a direct request for news.php, 2 an invalid use of a newsid array parameter to admin/edit-item.php, and possibly unspecified vectors related to additional scripts in 3 admin/, 4 rss/, and 5 the ro...

CVE-2007-5174

Directory traversal vulnerability in phpinc/news.php in actSite 1.56 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the do parameter...

CVE-2007-5174

Directory traversal vulnerability in phpinc/news.php in actSite 1.56 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the do parameter...

actSite 1.56 - 'news.php' Local File Inclusion

'/ -.- -----------------oOO------OOo----------------- | actSite v1.56 news.php Local File Inclusion | | coded by DNX | ------------------------------------------------- ! Discovered: DNX ! Vendor: http://www.actsite.de ! Detected: 02.09.2007 ! Reported: 02.09.2007 ! Remote: yes ! Background:...

actSite 1.56 - news.php Local File Inclusion

actSite 1.56 - news.php Local File Inclusion '/ -.- -----------------oOO------OOo----------------- | actSite v1.56 news.php Local File Inclusion | | coded by DNX | ------------------------------------------------- ! Discovered: DNX ! Vendor: http://www.actsite.de ! Detected: 02.09.2007 ! Reported...

TLM CMS SQL注入漏洞

TLM CMS是一款基于PHP的WEB应用程序。 TLM CMS不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL攻击，获得敏感信息或操作数据库。 问题是由于脚本对用户提交的WEB参数缺少过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，攻击者可以获得敏感信息或操作数据库。 TLM CMS 3.2 目前没有详细解决方案提供： http://tlm.hebserv.fr/home.php...

CVE-2007-4329

Multiple PHP remote file inclusion vulnerabilities in Web News 1.1 allow remote attackers to execute arbitrary PHP code via a URL in the configrootordner parameter to 1 index.php, 2 news.php, or 3 feed.php...

Sql injection

Multiple SQL injection vulnerabilities in eSyndiCat allow remote attackers to execute arbitrary SQL commands via 1 the id parameter to news.php or 2 the name parameter to page.php...

Sql injection

Multiple SQL injection vulnerabilities in Jasmine CMS 1.0 allow remote attackers to execute arbitrary SQL commands via 1 the loginusername parameter to login.php or 2 the item parameter to news.php...

CVE-2007-3313

Multiple SQL injection vulnerabilities in Jasmine CMS 1.0 allow remote attackers to execute arbitrary SQL commands via 1 the loginusername parameter to login.php or 2 the item parameter to news.php...

shnew31-rfi.txt

Found By : Hasadya Raed Contact : [email protected] --------------------------- Script : SH-News 3.1 Dork : "Powered by SH-News 3.1" Greetz : Guardian Information Systems --------------------------- B.Files : report.php archive.php comments.php init.php news.php Exploits :...

CVE-2007-2994

DGNews 2.1 contains a SQL injection vulnerability in news.php. Specifically, the vulnerability is exploitable via the newsid parameter in the fullnews action, allowing remote arbitrary SQL execution. This CVE is CVE-2007-2994; related CVE-2007-0693 covers a different vector (catid parameter in ne...

Sql injection

SQL injection vulnerability in news.php in DGNews 2.1 allows remote attackers to execute arbitrary SQL commands via the catid parameter in a newslist action. NOTE: this issue can produce resultant cross-site scripting XSS...

Design/Logic Flaw

DGNews 2.1 allows remote attackers to obtain sensitive information via a fullnews request to news.php with an invalid newsid parameter, and other unspecified vectors, which reveal the path in various error messages...

CVE-2007-0692

DGNews 2.1 allows remote attackers to obtain sensitive information via a fullnews request to news.php with an invalid newsid parameter, and other unspecified vectors, which reveal the path in various error messages...

CVE-2007-0692

DGNews 2.1 is affected by a path-disclosure vulnerability (CVE-2007-0692) in news.php (fullnews) when an invalid newsid parameter is supplied, potentially revealing server paths via error messages. The issue is triggered by the fullnews/news.php flow and related error output, with the advisory no...

DGNews 1.5.1/2.1 - 'news.php' SQL Injection

source: https://www.securityfocus.com/bid/24201/info DGNews is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. Successful exploits could allow an attacker to compromise the application, access or modif...

PT-2007-4165 · Saxon · Saxon

Name of the Vulnerable Software and Affected Versions: SAXON version 4.6 Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the template parameter to specific PHP files, including 1 "news.php", 2 "preview.php", or 3 "archive-display.php". Recommendations: Fo...

Flexphpnews 0.0.5 (news.php newsid) Remote SQL Injection Vulnerability

.-""""""""-. / Dj7xpl | | |, .-. .-. ,| | o/ o | |/ / | @ ^^ |IIIIII|/ @8@8|-IIIIII/-| / / @ +Iranian Are The Best In World+ Portal.......: Flexphpnews version 0.0.5 Download.....: http://www.china-on-site.com/flexphpsite/other.php Author.......: Dj7xpl |...