CVE-2006-6347: Undefined Security Weakness

Unrestricted file upload vulnerability in TFT-Gallery allows remote authenticated administrators to upload arbitrary .php files, possibly using admin/index.php. NOTE: this can be leveraged with CVE-2006-1412 to create a remote unauthenticated vector...

PT-2006-6801 · Active Php · Active Php Bookmarks

Name of the Vulnerable Software and Affected Versions: Active PHP Bookmarks version 1.1.02 Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the APB SETTINGS'apb path' parameter in 1 apb common.php or 2 apb.php. However, it is noted that the PHP scripts exi...

XSS in script Mobile

Discovered : SwEET-DeViL & HaCkEr sUn Product: http://www.ac4p.com tame : AL-garnei :::::::::::::::::::::::::::::::::::::::::: /1/ index.php http://www.site.com/path/index.php?Bloks=XSS http://www.site.com/path/index.php?Newnews=XSS http://www.site.com/path/index.php?lBlok=XSS...

AFGB GUESTBOOK 2.2 (Htmls) Remote File Include Vulnerabilities

No description provided by source. afgb GUESTBOOK V2.2 Htmls Remote File Include Vulnerability Turkish Hacker's Discovered By : mdX ------------------------------------------------------ Cyber-Warrior TIM Ay ve YIldIzlar Geceye YakISIr... the moon and the stars suit the night Class : REmote File...

CVE-2006-5027

CVE-2006-5027 affects JevonCMS (possibly pre-alpha). An attacker can remotely obtain sensitive information by directly requesting specific PHP include files (php/main/phplib files: db_msql.inc, db_mssql.inc, db_mysql.inc, db_oci8.inc, db_odbc.inc, db_oracle.inc, db_pgsql.inc, and db_sybase.inc). ...

PT-2006-5603 · Hitweb · Hitweb

Name of the Vulnerable Software and Affected Versions: Hitweb versions 3.0 Description: The issue concerns remote file inclusion vulnerabilities in Hitweb 3.0, allowing remote attackers to execute arbitrary PHP code. This is achieved by providing a URL in the REP CLASS parameter to various PHP...

CVE-2006-4743

CVE-2006-4743 affects WordPress 2.0.2 through 2.0.5, allowing remote attackers to obtain sensitive information by requesting specific PHP files (e.g., 404.php, akismet.php, archive.php, etc.), which causes error messages that reveal internal paths. The connected documents corroborate the list of ...

PT-2006-5352 · Yacs · Yacs Cms

Name of the Vulnerable Software and Affected Versions: YACS CMS version 6.6.1 Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the contextpath to root parameter in several PHP files, including "articles/populate.php", "categories/category.php",...

Tons of SQL-injections and XSS in Eichhorn Portal and vendor page

Hi list. There are lots of SQL injections and XSS in the 'Eichhorn Portal' by 'Guder und Koch Netzwerktechnik' and their own website. Input passed to multiple parameters in different PHP-files isn't properly sanitised before being returned to the user. This can be exploited to execute arbitrary...

Chaussette 080706 - _BASE Remote File Inclusion

Chaussette 080706 - BASE Remote File Inclusion Chaussette Remote File Inclusion CreW: ToXiC Bug Found By Drago84 Source Code: http://freshmeat.net/redir/chaussette/64502/urlzip/chaussette.zip Page Affect /Classes/Evenement.php /Classes/Event.php /Classes/Eventformonth.php...

CVE-2006-3884

Multiple SQL injection vulnerabilities in links.php in Gonafish LinksCaffe 3.0 allow remote attackers to execute arbitrary SQL commands via the 1 offset and 2 limit parameters, 3 newdays parameter in a new action, and the 4 linkid parameter in a deadlink action. NOTE: this issue can also be used...

CVE-2006-3884

Multiple SQL injection vulnerabilities in links.php in Gonafish LinksCaffe 3.0 allow remote attackers to execute arbitrary SQL commands via the 1 offset and 2 limit parameters, 3 newdays parameter in a new action, and the 4 linkid parameter in a deadlink action. NOTE: this issue can also be used...

PT-2006-4402 · Bosclassifieds · Bosclassifieds Classified Ads

Name of the Vulnerable Software and Affected Versions: BosClassifieds Classified Ads affected versions not specified Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the insPath parameter to various PHP files, including "index.php", "recent.php",...

free QBoard v1.1 Multiple Remote File include

free QBoard v1.1 Multiple Remote File include ------------------------------------------------- Discovered By CrAshoVeRrIdE Arabian Security Team ------------------------------------------------- site of script:http://sourceforge.net/projects/freeqboard/...

APBoardSQL.txt

APBoard 2.2-r3 = SQL Injections - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Discovered by: 666 SR-Crew Homepage: www.SR-Crew.de.tt - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Vendor: APBoard from APP Homepage: www.php-programs.de - - - - - - - - - - - - - - - - - -...

CVE-2006-2660

Buffer consumption vulnerability in the tempnam function in PHP 5.1.4 and 4.x before 4.4.3 allows local users to bypass restrictions and create PHP files with fixed names in other directories via a pathname argument longer than MAXPATHLEN, which prevents a unique string from being appended to the...

Remote file inclusion

PHP remote file inclusion vulnerability in Bookmark4U 2.0.0 and earlier allows remote attackers to include arbitrary PHP files via the includeprefix parameter in 1 inc/dbase.php, 2 inc/config.php, 3 inc/common.php, and 4 inc/function.php. NOTE: it has been reported that the inc directory is...

[MajorSecurity #9]HostAdmin <= 3.1 - Remote File Include Vulnerability

MajorSecurity 9HostAdmin = 3.1 - Remote File Include Vulnerability ------------------------------------------------------------------------- Software: HostAdmin Version: =3.1 Type: Remote File Include Vulnerability Date: June, 3rd 2006 Vendor: dreamcost Page: http://dreamcost.com Risc: High...

Sql injection

SQL injection vulnerability in Pre News Manager 1.0 allows remote attackers to execute arbitrary SQL commands via the 1 id parameter to a index.php, and the 2 nid parameter to b newsdetail.php, c emailstory.php, d thankyou.php, e printableview.php, f tellafriend.php, and g sendcomments.php. NOTE:...

Directory traversal

Multiple unspecified vulnerabilities in aMuleWeb for AMule before 2.1.2 allow remote attackers to read arbitrary image, HTML, or PHP files via unknown vectors, probably related to directory traversal...