phpwebgallery152.txt

Produce : PhpWebGallery = 1.5.2 Site : http://www.phpwebgallery.net Problem : XSS Greetz : hasnaa and all friends Moroccan Security Research Team Vulnerable file : comments.php Exploit : http://localhost/phpwebgallery/comments.php?keyword=%22%3EXSS...

PHPWebGallery 1.x - comments.php Cross-Site Scripting

PHPWebGallery 1.x - comments.php Cross-Site Scripting source: https://www.securityfocus.com/bid/18798/info PhpWebGallery is prone to a cross-site scripting vulnerability because it fails to sanitize input before displaying it to users of the application. An attacker may leverage this issue to hav...

PHPWebGallery 1.x - 'comments.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/18798/info PhpWebGallery is prone to a cross-site scripting vulnerability because it fails to sanitize input before displaying it to users of the application. An attacker may leverage this issue to have arbitrary script code execute in the browser of an...

Information disclosure

PhpWebGallery before 1.6.0RC1 allows remote attackers to obtain arbitrary pictures via a request to picture.php without specifying the cat parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information...

CVE-2006-2041

PhpWebGallery before 1.6.0RC1 allows remote attackers to obtain arbitrary pictures via a request to picture.php without specifying the cat parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information...

CVE-2006-2041

CVE-2006-2041 affects PhpWebGallery versions prior to 1.6.0RC1. The flaw allows remote attackers to obtain arbitrary pictures by issuing a request to picture.php without the required cat parameter. The underlying impact is a partial disclosure of data (information exposure) as reflected in the CV...

CVE-2006-2041

PhpWebGallery before 1.6.0RC1 allows remote attackers to obtain arbitrary pictures via a request to picture.php without specifying the cat parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information...

CVE-2006-2041: Undefined Security Weakness

PhpWebGallery before 1.6.0RC1 allows remote attackers to obtain arbitrary pictures via a request to picture.php without specifying the cat parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information...

[SA19801] PhpWebGallery "picture.php" Disclosure of Arbitrary Pictures

TITLE: PhpWebGallery "picture.php" Disclosure of Arbitrary Pictures SECUNIA ADVISORY ID: SA19801 VERIFY ADVISORY: http://secunia.com/advisories/19801/ CRITICAL: Less critical IMPACT: Security Bypass, Exposure of sensitive information WHERE: From remote SOFTWARE: PhpWebGallery 1.x...

PHPWebGallery Multiple Cross Site Scripting Vulnerabilities

Title : PHPWebGallery Multiple Cross Site Scripting Vulnerabilities Author: Mourad aka Psych0 root at linuxmail org Moroccan Security Team Vendor: www.phpwebgallery.net Software: PHPWebGallery Version: 1.4.1 category.php and picture.php scripts are vulnerable to XSS attacks. Exploits:...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in PHPWebGallery 1.4.1 allow remote attackers to inject arbitrary web script or HTML via the 1 cat, 2 num, and 3 search parameters to a category.php, and the 4 slideshow, 5 showmetadata, and 6 start parameters to b picture.php, a different...

CVE-2006-1674

Cross-site scripting XSS vulnerability in search.php in PHPWebGallery 1.4.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter, a different vulnerability than CVE-2006-1675...

CVE-2006-1675

Multiple cross-site scripting XSS vulnerabilities in PHPWebGallery 1.4.1 allow remote attackers to inject arbitrary web script or HTML via the 1 cat, 2 num, and 3 search parameters to a category.php, and the 4 slideshow, 5 showmetadata, and 6 start parameters to b picture.php, a different...

CVE-2006-1675

Multiple cross-site scripting XSS vulnerabilities in PHPWebGallery 1.4.1 allow remote attackers to inject arbitrary web script or HTML via the 1 cat, 2 num, and 3 search parameters to a category.php, and the 4 slideshow, 5 showmetadata, and 6 start parameters to b picture.php, a different...

CVE-2006-1674

CVE-2006-1674 affects PHPWebGallery 1.4.1, with a Cross-site Scripting (XSS) flaw in search.php where the id parameter can inject arbitrary script/HTML. The Red Hat advisory confirms the same vulnerability but does not provide patch details in the excerpt; other connected records reiterate the is...

CVE-2006-1675

PHPWebGallery 1.4.1 contains cross-site scripting (XSS) vulnerabilities tracked as CVE-2006-1675. The flaws permit remote attackers to inject arbitrary web script or HTML by supplying crafted values for (1) cat, (2) num, and (3) search parameters to category.php, and (4) slideshow, (5) show_metad...

CVE-2006-1674

Cross-site scripting XSS vulnerability in search.php in PHPWebGallery 1.4.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter, a different vulnerability than CVE-2006-1675...

PHPWebGallery 1.4.1 - picture.php Cross-Site Scripting

PHPWebGallery 1.4.1 - picture.php Cross-Site Scripting source: https://www.securityfocus.com/bid/17421/info PHPWebGallery is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may...

PHPWebGallery 1.4.1 - category.php Cross-Site Scripting

PHPWebGallery 1.4.1 - category.php Cross-Site Scripting source: https://www.securityfocus.com/bid/17421/info PHPWebGallery is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may...

PHPWebGallery 1.4.1 - 'picture.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/17421/info PHPWebGallery is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code executed...