CVE-2007-0892

CRLF injection vulnerability in phpMyVisites before 2.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the url parameter, when the pagename parameter begins with "FILE:"...

CVE-2007-0891

Cross-site scripting XSS vulnerability in the GetCurrentCompletePath function in phpmyvisites.php in phpMyVisites before 2.2 allows remote attackers to inject arbitrary web script or HTML via the query string...

CVE-2007-0893

Directory traversal vulnerability in phpMyVisites before 2.2 allows remote attackers to include arbitrary files via leading ".." sequences on the pmvckview COOKIE parameter, which bypasses the protection scheme...

Directory traversal

Directory traversal vulnerability in phpMyVisites before 2.2 allows remote attackers to include arbitrary files via leading ".." sequences on the pmvckview COOKIE parameter, which bypasses the protection scheme...

Cross site scripting

Cross-site scripting XSS vulnerability in the GetCurrentCompletePath function in phpmyvisites.php in phpMyVisites before 2.2 allows remote attackers to inject arbitrary web script or HTML via the query string...

CVE-2007-0891

CVE-2007-0891 affects phpMyVisites prior to 2.2. The XSS vulnerability resides in GetCurrentCompletePath in phpmyvisites.php, allowing remote attackers to inject arbitrary script/HTML via the query string. Impact: possible client-side script execution. Remediation: upgrade to version 2.2 or later...

CVE-2007-0891

Cross-site scripting XSS vulnerability in the GetCurrentCompletePath function in phpmyvisites.php in phpMyVisites before 2.2 allows remote attackers to inject arbitrary web script or HTML via the query string...

CVE-2007-0892

The CVE-2007-0892 issue affects phpMyVisites prior to 2.2, where a CRLF injection via the url parameter enables HTTP header injection and response splitting when the pagename starts with "FILE:". This is a remote, network-accessible vulnerability in the web frontend that can alter HTTP headers an...

CVE-2007-0892

CRLF injection vulnerability in phpMyVisites before 2.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the url parameter, when the pagename parameter begins with "FILE:"...

CVE-2007-0893

Directory traversal vulnerability in phpMyVisites before 2.2 allows remote attackers to include arbitrary files via leading ".." sequences on the pmvckview COOKIE parameter, which bypasses the protection scheme...

CVE-2007-0893

CVE-2007-0893 affects phpMyVisites prior to version 2.2. A directory traversal flaw lets remote attackers include arbitrary files by supplying leading ".." sequences in the pmv_ck_view cookie parameter, bypassing the protection scheme. This is a straightforward file inclusion risk that can impact...

[Full-disclosure] Multiple vulnerabilities in phpMyVisites

Multiple vulnerabilities in phpMyVisites Application : phpMyVisites prior to 2.2 stable Release Date : 11 February 2007 Author : Nicob nicob at nicob.net Abstract : ========== Several vulnerabilities were identified in phpMyVisites. This software is "a free and powerful open source GNU/GPL softwa...

phpMyVisites.txt

================================================================== File: phpMyVisites 1.3 local file retrieval From: remote Date: 26/04/2005 Credits: Max Cerny maxatczernydotcz Vendor: http://www.phpmyvisites.net Affected version: 1.3, not tested...

CVE-2005-1324

Multiple cross-site scripting XSS vulnerabilities in index.php for phpMyVisites allow remote attackers to inject arbitrary web script or HTML via the 1 part, 2 per, or 3 site parameters...

CVE-2005-1325

setlang.php in phpMyVisites 1.3 allows remote attackers to read and include arbitrary files via the mylang parameter...

CVE-2005-1324

Multiple cross-site scripting XSS vulnerabilities in index.php for phpMyVisites allow remote attackers to inject arbitrary web script or HTML via the 1 part, 2 per, or 3 site parameters...

CVE-2005-1324

CVE-2005-1324 affects phpMyVisites via multiple XSS in index.php. The vulnerability allows remote attackers to inject arbitrary scripts/HTML through the (1) part, (2) per, or (3) site parameters. The issue originates from improper handling of user-supplied input in the index.php script, enabling ...

CVE-2005-1325

CVE-2005-1325 affects phpMyVisites 1.3, where the file set_lang.php processes a mylang parameter in a way that allows remote attackers to read and include arbitrary files. The underlying flaw is the uncontrolled file handling via the mylang input, enabling arbitrary file access/inclusion. Documen...

CVE-2005-1325

setlang.php in phpMyVisites 1.3 allows remote attackers to read and include arbitrary files via the mylang parameter...

PHPMyVisites 1.3 - 'Set_Lang' File Inclusion

source: https://www.securityfocus.com/bid/13370/info phpMyVisites allows attackers to include arbitrary files. While it has been demonstrated that local files may be included through this vulnerability, there is an unconfirmed possibility of remote file inclusion. Exploitation could disclose loca...