1117 matches found
CVE-2008-2644
Multiple cross-site scripting XSS vulnerabilities in SMEWeb 1.4b and 1.4f allow remote attackers to inject arbitrary web script or HTML via the 1 data parameter to catalog.php, the 2 keyword parameter to search.php, the 3 page parameter to bb.php, and the 4 news parameter to order.php...
PT-2008-3301 · Blogator · Blogator-Script
Name of the Vulnerable Software and Affected Versions: Blogator-script version 1.0 Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the incl page parameter in several PHP files, including struct admin.php, struct admin blog.php, and struct main.php in the...
CVE-2008-1128
PHP remote file inclusion vulnerability in tourney/index.php in phpMyTourney 2 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter...
CVE-2008-1061
Multiple cross-site scripting XSS vulnerabilities in the Sniplets 1.1.2 and 1.2.2 plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 text parameter to a warning.php, b notice.php, and c inset.php in view/sniplets/, and possibly d modules/execute.php; the ...
CVE-2008-0745
Directory traversal vulnerability in aides/index.php in DomPHP 0.82 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the page parameter...
Directory traversal
Multiple directory traversal vulnerabilities in PowerScripts PowerNews 2.5.6 allow remote attackers to read and include arbitrary files via a .. dot dot in the 1 subpage parameter in a categories.inc.php, b news.inc.php, c other.inc.php, d permissions.inc.php, e templates.inc.php, and f...
CVE-2008-0545
CVE-2008-0545 describes multiple directory traversal vulnerabilities in Bubbling Library 1.32. The issue allows remote attackers to include and execute arbitrary local files via a .. in the uri parameter passed to dispatcher/framework/ templates (yui-menu.tpl.php, simple.tpl.php, advanced.tpl.php...
Aria 0.99-6 (effect.php page) Local File Inclusion Vulnerability
No description provided by source. Digital Security Research Group DSecRG Advisory DSECRG-08-002 Application: aria-0.99-6 Web based ERP Versions Affected: aria-0.99-6 Vendor URL: http://www.tucows.net/ Bug: Local File Include Exploits: YES Reported: 09.01.2008 Vendor Response: None Date of Public...
DEBIAN-CVE-2008-0195
WordPress 2.0.11 and earlier allows remote attackers to obtain sensitive information via an empty value of the page parameter to certain PHP scripts under wp-admin/, which reveals the path in various error messages...
CVE-2008-0195
WordPress 2.0.11 and earlier allows remote attackers to obtain sensitive information via an empty value of the page parameter to certain PHP scripts under wp-admin/, which reveals the path in various error messages...
CVE-2008-0186
Cross-site scripting XSS vulnerability in index.php in NetRisk 1.9.7 and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the page parameter, possibly related to CVE-2008-0144...
CVE-2007-6582
Directory traversal vulnerability in index.php in mBlog 1.2 allows remote attackers to read arbitrary files via a .. dot dot in the page parameter in a page mode action...
CVE-2007-5802
CVE-2007-5802 affects Firewolf Technologies Synergiser 1.2 RC1 and earlier. A directory traversal in index.php allows remote attackers to include and execute arbitrary local files by supplying a .. in the page parameter. This may enable including a local PHP script with a duplicate function decla...
Directory traversal
Directory traversal vulnerability in index.php in Artmedic CMS 3.4 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the page parameter...
CVE-2007-5297
Cross-site scripting XSS vulnerability in index.php in Minki 1.30 allows remote attackers to inject arbitrary web script or HTML via the page parameter...
CVE-2007-4764
CVE-2007-4764 affects Pawfaliki 0.5.1, where the PHP script pawfaliki.php is vulnerable to a directory-traversal via the page parameter. The root cause is improper handling of relative path components (..), enabling remote attackers to list arbitrary files. The vulnerability is documented in mult...
CVE-2007-3128
SQL injection vulnerability in content.php in WSPortal 1.0, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the page parameter...
Cross site scripting
Cross-site scripting XSS vulnerability in htdocs/php.php in OpenConcept Back-End CMS 0.4.7 allows remote attackers to inject arbitrary web script or HTML via the page parameter...
Cross site scripting
Cross-site scripting XSS vulnerability in index.php in Arizona Dream Livre d'or livor 2.5 allows remote attackers to inject arbitrary web script or HTML via the page parameter...