4353 matches found
Directory traversal
index.php in EZDatabase before 2.1.2 does not properly cleanse the p parameter before constructing and including a .php filename, which allows remote attackers to conduct directory traversal attacks, and produces resultant cross-site scripting XSS and path disclosure...
CVE-2006-0315
CVE-2006-0315 affects EZDatabase prior to 2.1.2. The vulnerability stems from improper cleansing of the p parameter when constructing and including a .php filename, enabling directory traversal. This can lead to cross-site scripting (XSS) and path disclosure. The available connected documents pro...
CVE-2005-4638
The CVE-2005-4638 entry involves Kayako SupportSuite 3.00.26 and earlier where the index.php in multiple modules (news, downloads, knowledgebase) can reveal the full server path via specific parameters: _a, newsid, downloaditemid, kbarticleid. This is a path disclosure vulnerability in the affect...
Trustix Secure Linux Security Advisory 2005.23
Multiple Vulnerabilities in brainsquad-team's CMS ================================================= Discovered on 23.12.2005 by yorn. Merry Christmas! Description: ------------ www.brainsquad-team.de The CMS from brainsquad-team is a php / sql based CMS system. Problems: -------- XSS: There are...
CVE-2006-0113
Enhanced Simple PHP Gallery 1.7 allows remote attackers to obtain the full path of the application via a direct request to sphelperfunctions.php, which leaks the pathname in an error message...
CVE-2006-0113
CVE-2006-0113 affects Enhanced Simple PHP Gallery 1.7. The issue arises when an attacker can trigger a direct request to sp_helper_functions.php, causing an error message to leak the application’s full path (pathname). This is a path-traversal/information-disclosure symptom that could aid targeti...
CVE-2006-0113
Enhanced Simple PHP Gallery 1.7 allows remote attackers to obtain the full path of the application via a direct request to sphelperfunctions.php, which leaks the pathname in an error message...
[ECHO_ADV_25$2006] Full path disclosure on boastMachine v3.1
/ / | | / // / | | Y / | / / /| / / / / / / .OR.ID ECHOADV25$2006 --------------------------------------------------------------------------- ECHOADV25$2006 Full path disclosure on boastMachine v3.1 --------------------------------------------------------------------------- Author : M.Hasran...
phpBB < 2.0.19 Multiple XSS
According to its version number, the remote version of this software is vulnerable to JavaScript injection issues using 'url' bbcode tags and, if HTML tags are enabled, HTML more generally. This may allow an attacker to inject hostile JavaScript into the forum system to steal cookie credentials o...
CVE-2005-4546
CVE-2005-4546 affects eggblog 2.0: the search.php module exposes the server full path to remote attackers via an invalid q parameter, with the description suggesting a possible SQL injection trigger. The concrete impact stated is path disclosure; no additional exploit details are provided in the ...
CVE-2005-4546
search.php in eggblog 2.0 allows remote attackers to obtain the full path via an invalid q parameter, as used by the Keyword and Search fields, possibly due to an SQL injection vulnerability...
phpBB2018.txt
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 phpBB 2.0.18 XSS and Full Path Disclosure cXIb8O3.22 Author: Maksymilian Arciemowicz cXIb8O3 Date: 16.12.2005 from securityreason.com TEAM - --- 0.Description --- phpBB is a high powered, fully scalable, and highly customizable Open Source bulletin...
phpBB Forum program:the old revolution met the new problem-the vulnerability warning-the black bar safety net
phpBB 2.0.18 XSS and Full Path Disclosure Details: SecurityAlert There is a brute force tool, a single thread, there is no useful,it rivals had a what phpbb what also can be used to run the password 下载 :http://ftpzhangxue.w205.100dns.com/tools/phpbb.rar Topic : phpBB 2.0.18 XSS and Full Path...
CVE-2005-4508
Nexus Concepts Dev Hound 2.24 and earlier allows remote attackers to obtain the installation path via a URL containing a non-existent .dll file...
CVE-2005-4495
The advisory concerns SpireMedia mx7, specifically the index.cfm script, where the cid parameter is vulnerable to SQL injection. The root cause is untrusted input used in SQL queries, enabling remote attackers to potentially run arbitrary SQL commands. Some sources also suggest this may illuminat...
PT-2005-5178 · Spiremedia · Spiremedia Mx7
Name of the Vulnerable Software and Affected Versions: SpireMedia mx7 affected versions not specified Description: A SQL injection issue in index.cfm allows remote attackers to potentially execute arbitrary SQL commands via the cid parameter. This might also lead to path disclosure from invalid S...
DEBIAN-CVE-2005-4463
WordPress before 1.5.2 allows remote attackers to obtain sensitive information via a direct request to 1 wp-includes/vars.php, 2 wp-content/plugins/hello.php, 3 wp-admin/upgrade-functions.php, 4 wp-admin/edit-form.php, 5 wp-settings.php, and 6 wp-admin/edit-form-comment.php, which leaks the path ...
CVE-2005-4463
WordPress before 1.5.2 allows remote attackers to obtain sensitive information via a direct request to 1 wp-includes/vars.php, 2 wp-content/plugins/hello.php, 3 wp-admin/upgrade-functions.php, 4 wp-admin/edit-form.php, 5 wp-settings.php, and 6 wp-admin/edit-form-comment.php, which leaks the path ...
[ECHO_ADV_24$2005] Full path disclosure on WordPress < 1.5.2
ECHO.OR.ID ECHOADV24$2005 --------------------------------------------------------------------------- ECHOADV24$2005 Full path disclosure on WordPress 1.5.2 --------------------------------------------------------------------------- Author: Dedi Dwianto Date: Dec, 20th 2005 Location: Indonesia,...
CVE-2005-4405
redqueen.cgi in Red Queen 1.02 and earlier allows remote attackers to obtain the full server path via invalid 1 yellowpageid, 2 skinid, 3 supplierid, and 4 module parameters, which leaks the path in an error message...