CVE-2009-1907: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in claroline/linker/notfound.php in Claroline 1.8.11 allows remote attackers to inject arbitrary web script or HTML via the Referer HTTP header...

picoflatcms060-lfi.txt

PicoFlatCMS 0.6.0 LFI http://www.sourceforge.net/projects/picoflatcms Same old thing: http://site/index.php?pagina=C:\boot.ini Fixme: if eregi"://", $pagina || eregi"?", $pagina $pagina = ""; include "notfound.php"; else include $pagina;...