CVE-2009-3367: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in An image gallery 1.0 allow remote attackers to inject arbitrary web script or HTML via the path parameter to 1 index.php and 2 main.php, and the 3 show parameter to main.php. NOTE: the provenance of this information is unknown; the details are...

CVE-2009-3366: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in navigation.php in An image gallery 1.0 allows remote attackers to list arbitrary directories via a .. dot dot in the path parameter...

Remote file inclusion

PHP remote file inclusion vulnerability in pages/pageHeader.php in OpenSiteAdmin 0.9.7 BETA allows remote attackers to execute arbitrary PHP code via a URL in the path parameter, a different vector than CVE-2008-0648...

CVE-2009-3317: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in pages/pageHeader.php in OpenSiteAdmin 0.9.7 BETA allows remote attackers to execute arbitrary PHP code via a URL in the path parameter, a different vector than CVE-2008-0648...

CVE-2009-1288

Multiple cross-site scripting XSS vulnerabilities in the Advanced Management Module AMM on the IBM BladeCenter, including the BladeCenter H with BPET36H 54, allow remote attackers to inject arbitrary web script or HTML via 1 the username in a login action or 2 the PATH parameter to...

CVE-2009-1288: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Advanced Management Module AMM on the IBM BladeCenter, including the BladeCenter H with BPET36H 54, allow remote attackers to inject arbitrary web script or HTML via 1 the username in a login action or 2 the PATH parameter to...

CVE-2008-6609

Cross-site scripting XSS vulnerability in phpcksec.php in Stefan Ott phpcksec 0.2 allows remote attackers to inject arbitrary web script or HTML via the path parameter...

CVE-2008-6609: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in phpcksec.php in Stefan Ott phpcksec 0.2 allows remote attackers to inject arbitrary web script or HTML via the path parameter...

DEBIAN-CVE-2009-1148

Directory traversal vulnerability in bsdispasmimetype.php in the BLOB streaming feature in phpMyAdmin before 3.1.3.1 allows remote attackers to read arbitrary files via directory traversal sequences in the filepath parameter $filename variable...

CVE-2008-6421: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in socialgameplay.php in Social Site Generator SSG 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the path parameter...

CVE-2008-6295

Multiple cross-site scripting XSS vulnerabilities in Camera Life 2.6.2b8 allow remote attackers to inject arbitrary web script or HTML via the q parameter to 1 search.php and 2 rss.php; the query string after the image name in 3 photos/photo; the path parameter to 4 folder.php; page parameter and...

CVE-2009-0444: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in GRBoard 1.8, when registerglobals is enabled and magicquotesgpc is disabled, allow remote attackers to execute arbitrary PHP code via a URL in the 1 theme parameter to a 179squareboxpdslist/view.php, b 179squareboxminishopexpand/view.php, c...

PHPAuctionSystem - Multiple Remote File Inclusions

PHPAuctionSystem - Multiple Remote File Inclusions »=======================================================================================================-X » » » PHPAuctionSystem Multiple Remote File Inclusion Vulnerability » » » » ======= ------d-------m------ ==== ==== » » || = | |o...

CVE-2008-5792

PHP remote file inclusion vulnerability in showjoined.php in Indiscripts Enthusiast 3.1.4, and possibly earlier, allows remote attackers to execute arbitrary PHP code via a URL in the path parameter. NOTE: the researcher also points out the analogous directory traversal issue...

CVE-2008-5792

PHP remote file inclusion vulnerability in showjoined.php in Indiscripts Enthusiast 3.1.4, and possibly earlier, allows remote attackers to execute arbitrary PHP code via a URL in the path parameter. NOTE: the researcher also points out the analogous directory traversal issue...

CVE-2008-5792

CVE-2008-5792 affects Indiscripts Enthusiast (3.1.4 and possibly earlier). The vulnerability is a PHP remote file inclusion in show_joined.php where an attacker can supply a URL in the path parameter to execute arbitrary PHP code on the server. The issue is also noted as a directory traversal con...

CVE-2008-5792: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in showjoined.php in Indiscripts Enthusiast 3.1.4, and possibly earlier, allows remote attackers to execute arbitrary PHP code via a URL in the path parameter. NOTE: the researcher also points out the analogous directory traversal issue...

CVE-2008-5729

CVE-2008-5729 describes multiple cross-site scripting (XSS) vulnerabilities in AIST NetCat 3.12 and earlier. The issues allow remote attackers to inject arbitrary web script or HTML via three vectors: (1) the form and (2) the control parameters to FCKeditor/neditor.php, and (3) the path parameter...

CVE-2008-4361: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in PowerPortal 2.0.13 allows remote attackers to list and possibly read arbitrary files via a .. dot dot in the path parameter to the default URI...

CVE-2008-2884: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in display.php in RSS-aggregator allows remote attackers to execute arbitrary PHP code via a URL in the path parameter. NOTE: some of these details are obtained from third party information...