SoftBB 0.1 - 'cmd' Remote Command Execution

!/usr/bin/perl Affected.scr..: SoftBB 0.1 Poc.ID........: 11060904 Type..........: PHP code execution, SQL Injection, Full Path Disclosure Risk.level....: High Vendor.Status.: Unpatched Src.download..: softbb.be Poc.link......: acid-root.new.fr/poc/11060904.txt Advisory.link.:...

koobi.txt

vendor:http://www.dream4.de dork:"powered by Koobi Pro 5.6" vuln : http://host/index.php?p=showtopic&toid=SQL http://host/index.php?p=showtopic&toid=XSS Path Disclosure:http://host/index.php?area=1&p=' Author : Vampire [email protected] Homepage : Www.HackerZ.iR Www.H4ckerZ.Com Iran...

OZJournal15.txt

OZJournal v1.5 Homepage: http://ozjournals.awardspace.com/index.php Affected files: search input box index.php viewing archives show comment page ---------------------------------------- XSS vulnerability via search input box: Data isn't properly sanatized before being displayed. For a PoC in the...

Koobi Pro CMS 5.6 SQL injection & XSS

vendor:http://www.dream4.de dork:"powered by Koobi Pro 5.6" vuln : http://host/index.php?p=showtopic&toid=SQL http://host/index.php?p=showtopic&toid=XSS Path Disclosure:http://host/index.php?area=1&p=' Author : Vampire [email protected] Homepage : Www.HackerZ.iR Www.H4ckerZ.Com Iran...

OZJournal v1.5 - XSS

OZJournal v1.5 Homepage: http://ozjournals.awardspace.com/index.php Affected files: search input box index.php viewing archives show comment page ---------------------------------------- XSS vulnerability via search input box: Data isn't properly sanatized before being displayed. For a PoC in the...

CVE-2006-3884

Multiple SQL injection vulnerabilities in links.php in Gonafish LinksCaffe 3.0 allow remote attackers to execute arbitrary SQL commands via the 1 offset and 2 limit parameters, 3 newdays parameter in a new action, and the 4 linkid parameter in a deadlink action. NOTE: this issue can also be used...

CVE-2006-3884

Multiple SQL injection vulnerabilities in links.php in Gonafish LinksCaffe 3.0 allow remote attackers to execute arbitrary SQL commands via the 1 offset and 2 limit parameters, 3 newdays parameter in a new action, and the 4 linkid parameter in a deadlink action. NOTE: this issue can also be used...

Full Path Disclosure xGuestBook v1.02

Dicomdk Full Path Disclosure xGuestBook v1.02 http://xatrix.xa.funpic.de/xguestbook2/ By : X-boy http://HOST/post.php Test : http://xatrix.xa.funpic.de/xguestbook2/post.php Result : ======== Notice: Undefined index: user in sitepost.php on line 15 Notice: Undefined index: mail in sitepost.php on...

SQL-Injection in Shop-Script PRO & Shop-Script Premium all version

Advisory: SQL-Injection in Shop-Script PRO & Shop-Script Premium all version. Home Page: http://shop-script.ru Уязвимость/Vulnerability: SQL-injection в зоне администрирования. Уязвимый скрипт/Vulnerable script: admin.php...

DotClear : Multiples Full Path Disclosure

DotClear : Multiples Full Path Disclosure Discovred By Silitix - Silitixgmailcom www.Silitix.com A remote user can access the files directly to cause the system to display an error message that indicates the full path of the server. /ecrire/tools/blogroll/editcat.php...

CVE-2006-3682

awstats.pl in AWStats 6.5 build 1.857 and earlier allows remote attackers to obtain the installation path via the 1 year, 2 pluginmode or 3 month parameters...

CVE-2006-3682

awstats.pl in AWStats 6.5 build 1.857 and earlier allows remote attackers to obtain the installation path via the 1 year, 2 pluginmode or 3 month parameters...

CVE-2006-3566

CVE-2006-3566 affects HiveMail 3.1 and earlier. The vulnerability lies in search.results.php, where certain manipulations of the (1) searchdate and (2) folderids parameters allow remote attackers to obtain the installation path. This is an information-disclosure flaw. The available documents do n...

CVE-2006-3390

WordPress 2.0.3 allows remote attackers to obtain the installation path via a direct request to various files, such as those in the 1 wp-admin, 2 wp-content, and 3 wp-includes directories, possibly due to uninitialized variables...

CVE-2006-3390

WordPress 2.0.3 allows remote attackers to obtain the installation path via a direct request to various files, such as those in the 1 wp-admin, 2 wp-content, and 3 wp-includes directories, possibly due to uninitialized variables...

CVE-2006-3390

WordPress 2.0.3 is affected: a vulnerability allows remote attackers to disclose the installation path via direct requests to files in wp-admin, wp-content, and wp-includes (likely due to uninitialized variables). The issue is described for CVE-2006-3390 (and related CVEs) with impact on confiden...

CVE-2006-3390

WordPress 2.0.3 allows remote attackers to obtain the installation path via a direct request to various files, such as those in the 1 wp-admin, 2 wp-content, and 3 wp-includes directories, possibly due to uninitialized variables...

WordPress <= 2.0.3 - Full Path Disclosure

Because of this vulnerabilitity, attackers can obtain the installation path via a direct request to various files for the example, wp-includes directories, wp-content, and wp-admin. Solution Update the WordPress to the latest available version at least 2.0.4...

phpBB 2.0.21 Full Path Disclosure

------------------------------------------------------------------- phpBB 2.0.21 Full Path Disclosure ------------------------------------------------------------------- Discovered By zero Moroccan Security Team ------------------------------------------------------------------- Details Software:...

Zen-Cart 1.3.0.2 Full Path Disclosure

Zen-Cart 1.3.0.2 En: Zen-Cart .. E-commerce PHP Program - This Bug Can Tell U Where The Program @ Server Ar: .. Full Path Disclosure :- /index.php?GET= /index.php?SESSION= /index.php?POST= /index.php?COOKIE= /index.php?SESSION= /------------------------------------------/...