812 matches found
PHP-Fusion <= 4.0.1 'members.php' SQLi Vulnerability
A vulnerability exists in PHP-Fusion that may allow an attacker to inject arbitrary SQL code and possibly execute arbitrary code, due to improper validation of user supplied input in the SPDX-FileCopyrightText: 2004 David Maciejak Some text descriptions might be excerpted from a referenced source...
[SA17312] PHP-Fusion "news_body" Script Insertion Vulnerability
TITLE: PHP-Fusion "newsbody" Script Insertion Vulnerability SECUNIA ADVISORY ID: SA17312 VERIFY ADVISORY: http://secunia.com/advisories/17312/ CRITICAL: Moderately critical IMPACT: Cross Site Scripting WHERE: From remote SOFTWARE: PHP-Fusion 6.x http://secunia.com/product/5291/ DESCRIPTION: peanu...
Possible Bug in PHP-Fusion 6.0.204
There is a Bug in The News-System: Post something like: memetata http-equiv = "refresh" content = "1; URL = http://www.google.com" and you'll be redirected to google. Possible Solution: use a recursive function to filter metatags...
PHP-Fusion < 6.00.205 HTML Injection
Binary data 3267.prm...
PHP-Fusion < 6.00.110 Multiple Scripts SQL Injection
The remote version of this software is vulnerable to multiple SQL injection attacks due to its failure to properly sanitize certain parameters. Provided PHP's 'magicquotesgpc' setting is disabled, these flaws allow an attacker to manipulate database queries, which may result in the disclosure or...
CVE-2005-3160
Multiple SQL injection vulnerabilities in photogallery.php in PHP-Fusion allow remote attackers to execute arbitrary SQL commands via the 1 album and 2 photo parameters...
CVE-2005-3161
Multiple SQL injection vulnerabilities in PHP-Fusion before 6.00.110 allow remote attackers to execute arbitrary SQL commands via 1 the activate parameter in register.php and 2 the catid parameter in faq.php...
CVE-2005-3158
SQL injection vulnerability in messages.php in PHP-Fusion 6.00.106 and 6.00.107 allows remote attackers to execute arbitrary SQL commands via the 1 pmemailnotify and 2 pmsavesent parameters, a different vulnerability than CVE-2005-3157 and CVE-2005-3159...
CVE-2005-3157
SQL injection vulnerability in messages.php in PHP-Fusion 6.00.109 allows remote attackers to execute arbitrary SQL commands via the msgsend parameter, a different vulnerability than CVE-2005-3158 and CVE-2005-3159...
CVE-2005-3159
SQL injection vulnerability in messages.php in PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the msgview parameter, a different vulnerability than CVE-2005-3157 and CVE-2005-3158...
CVE-2005-3161
PHP-Fusion
CVE-2005-3158
PHP-Fusion
CVE-2005-3158
SQL injection vulnerability in messages.php in PHP-Fusion 6.00.106 and 6.00.107 allows remote attackers to execute arbitrary SQL commands via the 1 pmemailnotify and 2 pmsavesent parameters, a different vulnerability than CVE-2005-3157 and CVE-2005-3159...
CVE-2005-3159
SQL injection vulnerability in messages.php in PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the msgview parameter, a different vulnerability than CVE-2005-3157 and CVE-2005-3158...
CVE-2005-3160
Multiple SQL injection vulnerabilities in photogallery.php in PHP-Fusion allow remote attackers to execute arbitrary SQL commands via the 1 album and 2 photo parameters...
CVE-2005-3161
Multiple SQL injection vulnerabilities in PHP-Fusion before 6.00.110 allow remote attackers to execute arbitrary SQL commands via 1 the activate parameter in register.php and 2 the catid parameter in faq.php...
CVE-2005-3157
SQL injection vulnerability in messages.php in PHP-Fusion 6.00.109 allows remote attackers to execute arbitrary SQL commands via the msgsend parameter, a different vulnerability than CVE-2005-3158 and CVE-2005-3159...
CVE-2005-3159
CVE-2005-3159 is a SQL injection vulnerability in PHP-Fusion, specifically in messages.php where the msg_view parameter can be exploited to execute arbitrary SQL. It is described as a different vulnerability from CVE-2005-3157 and CVE-2005-3158, and is rated HIGH (CVSS v2 base score 7.5) with net...
CVE-2005-3157
CVE-2005-3157 describes an SQL injection in PHP-Fusion 6.00.109 caused by unsafely handling the msg_send parameter in messages.php. The vulnerability allows remote attackers to execute arbitrary SQL commands, with a likely impact on confidentiality, integrity, and availability as defined by the C...