PT-2017-13231

Name of the Vulnerable Software and Affected Versions NexusPHP version 1.5.beta5.20120707 Description A Cross Site Scripting XSS issue exists, allowing attackers to execute malicious scripts. This is achieved by manipulating the PATH INFO to ipsearch.php, which is related to the PHP SELF variable...

PT-2017-18930

Name of the Vulnerable Software and Affected Versions flatCore version 1.4.6 Description The issue is related to a cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary JavaScript code via the PATH INFO in an acp.php URL. This is due to the use of unsanitized $...

DEBIAN-CVE-2016-5702

phpMyAdmin 4.6.x before 4.6.3, when the environment lacks a PHPSELF value, allows remote attackers to conduct cookie-attribute injection attacks via a crafted URI...

UBUNTU-CVE-2016-5702

phpMyAdmin 4.6.x before 4.6.3, when the environment lacks a PHPSELF value, allows remote attackers to conduct cookie-attribute injection attacks via a crafted URI...

PT-2012-5938

Name of the Vulnerable Software and Affected Versions Limny version 3.0.1 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the PATH INFO, related to the PHP SELF variable. Recommendations For Limny version 3.0.1, consider...

CVE-2009-5077

CRE Loaded before 6.2.14 allows remote attackers to bypass authentication and gain administrator privileges via vectors related to a modified PHPSELF variable, which is not properly handled by 1 includes/applicationtop.php and 2 admin/includes/applicationtop.php...

DEBIAN-CVE-2007-2627

Cross-site scripting XSS vulnerability in sidebar.php in WordPress, when custom 404 pages that call getsidebar are used, allows remote attackers to inject arbitrary web script or HTML via the query string PHPSELF, a different vulnerability than CVE-2007-1622...

DEBIAN-CVE-2006-0806

Multiple cross-site scripting XSS vulnerabilities in ADOdb 4.71, as used in multiple packages such as phpESP, allow remote attackers to inject arbitrary web script or HTML via 1 the nextpage parameter in adodb-pager.inc.php and 2 other unspecified vectors related to PHPSELF...

PHProjekt 2.x/3.x - Authentication Bypass

source: https://www.securityfocus.com/bid/4596/info PHProjekt is a freely available, open source PHP Groupware package. It is actively maintained by the PHPProjekt Development Team. It will run on most Linux and Unix variants, in addition to Microsoft Windows operating systems. Some of the...