EUVD-2013-3473

Malware in sbrugna...

CVE-2010-4360: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in index.php in Jurpopage 0.2.0 allow remote attackers to execute arbitrary SQL commands via the 1 note and 2 pg parameters, different vectors than CVE-2010-4359. NOTE: the provenance of this information is unknown; the details are obtained solely from third...

CVE-2009-4672: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in main.php in the WP-Lytebox plugin 1.3 for WordPress allows remote attackers to include and execute arbitrary local files via a .. dot dot in the pg parameter...

CVE-2008-4751: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in iPei Guestbook 2.0 allows remote attackers to inject arbitrary web script or HTML via the pg parameter, a different vector than CVE-2005-4597...

CVE-2007-6057

PHP remote file inclusion vulnerability in index.php in datecomm Social Networking Script aka Myspace Clone Script allows remote attackers to execute arbitrary PHP code via a URL in the pg parameter...

CVE-2007-6057: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in index.php in datecomm Social Networking Script aka Myspace Clone Script allows remote attackers to execute arbitrary PHP code via a URL in the pg parameter...

CVE-2007-3451: Undefined Security Weakness

PHP remote file inclusion vulnerability in admin/index.php in 6ALBlog allows remote authenticated administrators to execute arbitrary PHP code via a URL in the pg parameter...

CVE-2007-2341: Undefined Security Weakness

PHP remote file inclusion vulnerability in suite/index.php in phpBandManager 0.8 allows remote attackers to execute arbitrary PHP code via a URL in the pg parameter...

CVE-2006-1224: Undefined Security Weakness

Directory traversal vulnerability in dwnld.php in GuppY 4.5.11 allows remote attackers to overwrite arbitrary files via a "%2E." mixed encoding in the pg parameter...

CVE-2006-1099

PHP remote file include vulnerability in logIT 1.3 and 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the pg parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Design/Logic Flaw

PHP remote file include vulnerability in logIT 1.3 and 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the pg parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2006-1099: Undefined Security Weakness

PHP remote file include vulnerability in logIT 1.3 and 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the pg parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2006-1013: Undefined Security Weakness

PHP remote file include vulnerability in index.php in SMartBlog aka SMBlog 1.2 allows remote attackers to include and execute arbitrary PHP files via 1 the pg parameter and 2 a query string without a parameter...

CVE-2006-0111

Cross-site scripting vulnerability in index.php in Boxcar Media Shopping Cart allows remote attackers to inject arbitrary web script or HTML via the 1 parent or 2 pg parameter...

Cross site scripting

Cross-site scripting vulnerability in index.php in Boxcar Media Shopping Cart allows remote attackers to inject arbitrary web script or HTML via the 1 parent or 2 pg parameter...

CVE-2006-0111: Undefined Security Weakness

Cross-site scripting vulnerability in index.php in Boxcar Media Shopping Cart allows remote attackers to inject arbitrary web script or HTML via the 1 parent or 2 pg parameter...

CVE-2006-0111

Cross-site scripting vulnerability in index.php in Boxcar Media Shopping Cart allows remote attackers to inject arbitrary web script or HTML via the 1 parent or 2 pg parameter...

CVE-2005-4617: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in tickets.php in cSupport 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the pg parameter...

CVE-2005-3156: Undefined Security Weakness

Directory traversal vulnerability in printfaq.php in EasyGuppy Guppy for Windows 4.5.4 and 4.5.5 allows remote attackers to read arbitrary files via ".." sequences in the pg parameter, which is cleansed for XSS but not directory traversal...

CVE-2005-2853: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in GuppY 4.5.3a and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the pg parameter to printfaq.php, or the 2 Referer or 3 User-Agent HTTP headers, which are not properly handled by error.php...