980 matches found
CVE-2006-1204
Multiple cross-site scripting XSS vulnerabilities in txtForum 1.0.4-dev and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 prev, 2 next, and 3 rand5 parameters in a index.php; the 4 rusername and 5 rloc parameters in b newtopic.php; the 6 rnum, 7 rfamilyname, 8...
CVE-2006-1219: Undefined Security Weakness
Directory traversal vulnerability in Gallery 2.0.3 and earlier, and 2.1 before RC-2a, allows remote attackers to include arbitrary PHP files via ".." dot dot sequences in the stepOrder parameter to 1 upgrade/index.php or 2 install/index.php...
Directory traversal
Directory traversal vulnerability in Nodez 4.6.1.1 and earlier allows remote attackers to read or include arbitrary PHP files via a .. dot dot in the op parameter, as demonstrated by inserting malicious Email parameters into list.gtdat, then accessing list.gtdat using the op parameter...
CVE-2006-1162
Directory traversal vulnerability in Nodez 4.6.1.1 and earlier allows remote attackers to read or include arbitrary PHP files via a .. dot dot in the op parameter, as demonstrated by inserting malicious Email parameters into list.gtdat, then accessing list.gtdat using the op parameter...
CVE-2006-1162
CVE-2006-1162 : A directory traversal in Nodez 4.6.1.1 and earlier allows remote attackers to read or include arbitrary PHP files via a .. in the op parameter, demonstrated by inserting malicious Email parameters into list.gtdat and accessing it with op. Root cause is improper path handling enabl...
CVE-2006-1162
Directory traversal vulnerability in Nodez 4.6.1.1 and earlier allows remote attackers to read or include arbitrary PHP files via a .. dot dot in the op parameter, as demonstrated by inserting malicious Email parameters into list.gtdat, then accessing list.gtdat using the op parameter...
CVE-2006-1162: Undefined Security Weakness
Directory traversal vulnerability in Nodez 4.6.1.1 and earlier allows remote attackers to read or include arbitrary PHP files via a .. dot dot in the op parameter, as demonstrated by inserting malicious Email parameters into list.gtdat, then accessing list.gtdat using the op parameter...
Code injection
response.c in Lighttpd 1.4.10 and possibly previous versions, when run on Windows, allows remote attackers to read arbitrary source code via requests that contain trailing 1 "." dot and 2 space characters, which are ignored by Windows, as demonstrated by PHP files...
CVE-2006-0814
response.c in Lighttpd 1.4.10 and possibly previous versions, when run on Windows, allows remote attackers to read arbitrary source code via requests that contain trailing 1 "." dot and 2 space characters, which are ignored by Windows, as demonstrated by PHP files...
CVE-2005-4463
WordPress before 1.5.2 allows remote attackers to obtain sensitive information via a direct request to 1 wp-includes/vars.php, 2 wp-content/plugins/hello.php, 3 wp-admin/upgrade-functions.php, 4 wp-admin/edit-form.php, 5 wp-settings.php, and 6 wp-admin/edit-form-comment.php, which leaks the path ...
CVE-2005-4449
verify.php in FlatNuke 2.5.6 allows remote authenticated administrators to modify arbitrary PHP files by setting the file parameter to an arbitrary file and injecting the code into the body parameter. NOTE: if a FlatNuke administrator is normally assumed to be able to modify arbitrary content, th...
CVE-2005-4319
Directory traversal vulnerability in index2.php in Limbo CMS 1.0.4.2 and earlier allows remote attackers to include arbitrary PHP files via ".." sequences in the option parameter...
CVE-2005-4227
Multiple "potential" SQL injection vulnerabilities in DCP-Portal 6.1.1 might allow remote attackers to execute arbitrary SQL commands via 1 the password and username parameters in advertiser.php, 2 the aid parameter in announcement.php, 3 the dcp5memberid, year, agid, day, days, hour, minute,...
CVE-2005-4034
Multiple SQL injection vulnerabilities in Web4Future eDating Professional 5 allow remote attackers to execute arbitrary SQL commands via the 1 s, 2 pg, and 3 sortb parameters to a index.php; 4 cid parameter to b gift.php and c fq.php; and 5 cat parameter to d articles.php...
CVE-2005-3824
The uploads module in vTiger CRM 4.2 and earlier allows remote attackers to upload arbitrary files, such as PHP files, via the add2db action...
CVE-2002-2200
Benjamin Lefevre Dobermann FORUM 0.5 and earlier allows remote attackers to remotely include and execute malicious PHP files via the "subpath" variablein 1 entete.php, 2 enteteacceuil.php, 3 index.php, or 4 newtopic.php...
CVE-2002-2200: Undefined Security Weakness
Benjamin Lefevre Dobermann FORUM 0.5 and earlier allows remote attackers to remotely include and execute malicious PHP files via the "subpath" variablein 1 entete.php, 2 enteteacceuil.php, 3 index.php, or 4 newtopic.php...
CVE-2005-3133
Multiple directory traversal vulnerabilities in MERAK Mail Server 8.2.4r with Icewarp Web Mail 5.5.1, and possibly earlier versions, allows remote attackers to 1 delete arbitrary files or directories via a relative path to the id parameter to logout.html or 2 include arbitrary PHP files or other...