Vulnerability in theme Pool 1.0.7 for WordPress

Здравствуйте 3APA3A! Сообщаю вам о найденной мною Cross-Site Scripting уязвимости в теме Pool 1.0.7 для WordPress. XSS: http://site/index.php/223E3Cscript3Ealertdocument.cookie3C/script3E Уязвимость связана с недостаточной фильтрацией переменной PHPSELF. Дополнительная информация о данной...

Vulnerability in theme WordPress Classic 1.5

Здравствуйте 3APA3A! Сообщаю вам о найденной мною Cross-Site Scripting уязвимости в теме WordPress Classic 1.5. XSS: http://site/index.php/223E3Cscript3Ealertdocument.cookie3C/script3E Уязвимость связана с недостаточной фильтрацией переменной PHPSELF. Подобная уязвимость ранее уже была найдена в...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Drupal 5.x before 5.2, and 4.7.x before 4.7.7, 1 allow remote attackers to inject arbitrary web script or HTML via "some server variables," including PHPSELF; and 2 allow remote authenticated administrators to inject arbitrary web script or HTM...

CVE-2007-4064

Multiple cross-site scripting XSS vulnerabilities in Drupal 5.x before 5.2, and 4.7.x before 4.7.7, 1 allow remote attackers to inject arbitrary web script or HTML via "some server variables," including PHPSELF; and 2 allow remote authenticated administrators to inject arbitrary web script or HTM...

CVE-2007-4064: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Drupal 5.x before 5.2, and 4.7.x before 4.7.7, 1 allow remote attackers to inject arbitrary web script or HTML via "some server variables," including PHPSELF; and 2 allow remote authenticated administrators to inject arbitrary web script or HTM...

CVE-2007-3963

Multiple cross-site scripting XSS vulnerabilities in UseBB 1.0.7, and possibly other 1.0.x versions, allow remote attackers to inject arbitrary web script or HTML via the PATHINFO PHPSELF to 1 upgrade-0-2-3.php, 2 upgrade-0-3.php, or 3 upgrade-0-4.php in install/, a different vulnerability than...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in UseBB 1.0.7, and possibly other 1.0.x versions, allow remote attackers to inject arbitrary web script or HTML via the PATHINFO PHPSELF to 1 upgrade-0-2-3.php, 2 upgrade-0-3.php, or 3 upgrade-0-4.php in install/, a different vulnerability than...

usebb-xss.txt

Script...............: UseBB version: 1.0.7 Script Site..........: http://www.usebb.net Vulnerability........: Cross Site Scripting XSS Acces................: Remote level................: Dangerous Author...............: S4mi Contact..............: s4miatLinuxMail.org The affected Files :...

UseBB 1.0.x Cross Site Scripting (XSS)

Script...............: UseBB version: 1.0.7 Script Site..........: http://www.usebb.net Vulnerability........: Cross Site Scripting XSS Acces................: Remote level................: Dangerous Author...............: S4mi Contact..............: s4miatLinuxMail.org The affected Files :...

CVE-2007-3517

Multiple cross-site scripting XSS vulnerabilities in Claroline 1.8.3 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO PHPSELF to 1 index.php, 2 demo/claroline170/index.php, and possibly other scripts...

CVE-2007-3517

CVE-2007-3517 covers multiple cross-site scripting (XSS) vulnerabilities in Claroline 1.8.3. An attacker can inject arbitrary web script or HTML by supplying malicious content through PATH_INFO (PHP_SELF) to scripts such as index.php and demo/claroline170/index.php (and potentially other scripts)...

CVE-2007-3517: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Claroline 1.8.3 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO PHPSELF to 1 index.php, 2 demo/claroline170/index.php, and possibly other scripts...

CVE-2007-3261

Cross-site scripting XSS vulnerability in widgets/widgetsearch.php in dKret before 2.6 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO PHPSELF...

CVE-2007-3261: Undefined Security Weakness

Cross-site scripting XSS vulnerability in widgets/widgetsearch.php in dKret before 2.6 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO PHPSELF...

CVE-2007-3239

Cross-site scripting XSS vulnerability in searchform.php in the AndyBlue theme before 20070607 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PHPSELF portion of a URI to index.php. NOTE: this can be leveraged for PHP code execution in an administrative sessio...

Cross site scripting

Cross-site scripting XSS vulnerability in searchform.php in the AndyBlue theme before 20070607 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PHPSELF portion of a URI to index.php. NOTE: this can be leveraged for PHP code execution in an administrative sessio...

CVE-2007-3239

Cross-site scripting XSS vulnerability in searchform.php in the AndyBlue theme before 20070607 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PHPSELF portion of a URI to index.php. NOTE: this can be leveraged for PHP code execution in an administrative sessio...

CVE-2007-3239

The CVE-2007-3239 entry describes an XSS vulnerability in the AndyBlue WordPress theme (pre-20070607) via the PHP_SELF value in searchform.php used by index.php. The underlying issue is reflected/script injection in the search form, which could be leveraged to execute arbitrary script or HTML in ...

CVE-2007-3241: Undefined Security Weakness

Cross-site scripting XSS vulnerability in blogroll.php in the cordobo-green-park theme for WordPress allows remote attackers to inject arbitrary web script or HTML via the PHPSELF portion of a URI...

WordPress Cordobo Green Park Theme - XSS

Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the PHPSELF portion of a URI. Solution Update the theme...