PhpGedView login page multiple XSS

Vendor Site: http://www.phpgedview.net Version: 4.1 Common Path: yoursite.com/genealogy/login.php Overview: Genealogy program which allows you to view and edit your genealogy on your website. It fails to sufficiently sanitize user-supplied input data in "User Name" text box leaving password blank...

PHPGedView 4.1 - login.php Cross-Site Scripting

PHPGedView 4.1 - login.php Cross-Site Scripting source: https://www.securityfocus.com/bid/25458/info PhpGedView is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. Exploiting this vulnerability may allow an attacker to perform cross-site...

PHPGedView 4.1 - 'login.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/25458/info PhpGedView is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. Exploiting this vulnerability may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the...

phpged.txt

========================================================================================================================== PhpGedView 4.0.2 DOCUMENTROOT File inclusion Vulnerablity ======================================= Script:PhpGedView ============= Version:4.0.2 ============= script...

PhpGedView 4.0.2 (DOCUMENT_ROOT) File inclusion Vulnerablity

========================================================================================================================== PhpGedView 4.0.2 DOCUMENTROOT File inclusion Vulnerablity ======================================= Script:PhpGedView ============= Version:4.0.2 ============= script...

Update Protection against phpBB and PHPGedView Remote Execution Vulnerabilities

phpBB is a widely used bulletin board software package. PhpGedView is a genealogy program which allows for genealogy viewing and editing on the Web. Several vulnerabilities reported in phpBB and in PhpGedView could allow an attacker to execute arbitrary PHP code...

PHPGedView.php.txt

--- PHPGedView password: nothing now in log file we have: 2005.12.20 13:16:06 - 127.0.0.1 - Login Failed - - so you can launch operating system commands: http://target/path/helptextvars.php?cmd=ls%20-la&PGVBASEDIRECTORY=./index/pgv-200512.log generally:...

CVE-2005-4469

Multiple direct static code injection vulnerabilities in PHPGedView 3.3.7 and earlier allow remote attackers to execute arbitrary PHP code via 1 the username field in login.php, or the 2 userlanguage, 3 useremail, and 4 usergedcomid parameters in loginregister.php, which is directly inserted into...

CVE-2005-4467: Undefined Security Weakness

Directory traversal vulnerability in helptextvars.php in PHPGedView 3.3.7 and earlier allows remote attackers to read and include arbitrary files via a .. dot dot in the PGVBASEDIRECTORY parameter...

CVE-2005-4467

Directory traversal vulnerability in helptextvars.php in PHPGedView 3.3.7 and earlier allows remote attackers to read and include arbitrary files via a .. dot dot in the PGVBASEDIRECTORY parameter...

CVE-2005-4468

PHP remote file include vulnerability in helptextvars.php in PHPGedView 3.3.7 and earlier allows remote attackers to execute arbitrary code via a URL in the PGVBASEDIRECTORY parameter...

CVE-2005-4468

The CVE-2005-4468 issue affects PHPGedView 3.3.7 and earlier, where a PHP remote file include vulnerability exists in help_text_vars.php. An attacker can supply a URL via the PGV_BASE_DIRECTORY parameter, leading to remote code execution on the affected host. This is evidenced by NVD descriptions...

CVE-2005-4467

CVE-2005-4467 affects PhpGedView up to version 3.3.7, with a directory traversal/remote file inclusion in help_text_vars.php via the PGV_BASE_DIRECTORY parameter. The underlying issue is insufficient input sanitization, allowing an attacker to read arbitrary files and, under certain conditions (e...

CVE-2005-4469: Undefined Security Weakness

Multiple direct static code injection vulnerabilities in PHPGedView 3.3.7 and earlier allow remote attackers to execute arbitrary PHP code via 1 the username field in login.php, or the 2 userlanguage, 3 useremail, and 4 usergedcomid parameters in loginregister.php, which is directly inserted into...

CVE-2005-4469

Multiple direct static code injection vulnerabilities in PHPGedView 3.3.7 and earlier allow remote attackers to execute arbitrary PHP code via 1 the username field in login.php, or the 2 userlanguage, 3 useremail, and 4 usergedcomid parameters in loginregister.php, which is directly inserted into...

CVE-2005-4468: Undefined Security Weakness

PHP remote file include vulnerability in helptextvars.php in PHPGedView 3.3.7 and earlier allows remote attackers to execute arbitrary code via a URL in the PGVBASEDIRECTORY parameter...

CVE-2005-4469

CVE-2005-4469 affects PhpGedView up to version 3.3.7. The vulnerability arises from multiple direct static code injections where user-controlled input in login.php (username) and login_register.php (user_language, user_email, user_gedcomid) is directly inserted into authenticate.php, enabling rem...

PhpGedView PGV_BASE_DIRECTORY Parameter Remote File Inclusion

The version of PhpGedView installed on the remote host fails to sanitize user-supplied input to the 'PGVBASEDIRECTORY' parameter of the 'helptextvars.php' script before using it in a PHP 'require' function. Provided PHP's 'registerglobals' setting is enabled, an unauthenticated attacker may be ab...

PhpGedView PGV_BASE_DIRECTORY Parameter Remote File Inclusion

Binary data 3333.prm...

PHPGedView <= 3.3.7 Arbitrary Remote Code Execution Exploit

No description provided by source. ?php ---phpgedview337xpl.php 16.31 20/12/2005 PHPGedView = 3.3.7 remote commands execution coded by rgod site: http://rgod.altervista.org usage: launch from Apache, fill in requested fields, then go! Sun-Tzu:"If the enemy leaves a door open, you must rush in...