64 matches found
CVE-2007-2368
picture.php in WebSPELL 4.01.02 and earlier allows remote attackers to read arbitrary files via the file parameter...
CVE-2007-2368
WebSPELL 4.01.02 (and earlier) is affected in picture.php where the file parameter can be abused to read arbitrary files. Root cause: improper handling of the file parameter allows remote attackers to access files, with no authentication and network-based access. The issue has a NVD CVSS v2 base ...
CVE-2007-2369: Undefined Security Weakness
Directory traversal vulnerability in picture.php in WebSPELL 4.01.02 and earlier, when PHP before 4.3.0 is used, allows remote attackers to read arbitrary files via a .. dot dot in the id parameter...
CVE-2007-2368: Undefined Security Weakness
picture.php in WebSPELL 4.01.02 and earlier allows remote attackers to read arbitrary files via the file parameter...
WebSPELL <= 4.01.02 (picture.php) File Disclosure Vulnerability
No description provided by source. WebSPELL = 4.01.02 picture.php Remote File Disclosure Vulnerabilitybr / Discovered by: Trexbr / Visit: www.Trex-Online.net / www.UnderGround.agbr / Comment: Happy easter!br / br / br / / / br / / / \/ / br /...
WebSPELL 4.01.02 - picture.php File Disclosure
WebSPELL 4.01.02 - picture.php File Disclosure WebSPELL = 4.01.02 picture.php Remote File Disclosure Vulnerability Discovered by: Trex Visit: www.Trex-Online.net / www.UnderGround.ag Comment: Happy easter! / \ / \ / / / \ \ / \ /\ // / GIVE ME A CARROT OR I WILL \ \O O/ \ BLOW UP YOUR HOUSE / /...
WebSPELL <= 4.01.02 (picture.php) File Disclosure Vulnerability
Exploit for unknown platform in category web applications =============================================================== WebSPELL = 4.01.02 picture.php File Disclosure Vulnerability =============================================================== WebSPELL = 4.01.02 picture.php Remote File...
Remote file inclusion
Multiple PHP remote file inclusion vulnerabilities in Advanced Guestbook 2.4.2 allow remote attackers to execute arbitrary PHP code via a URL in the includepath parameter to 1 index.php, 2 addentry.php, or 3 picture.php, a different set of vectors than CVE-2006-5804. NOTE: this issue has been...
CVE-2007-0530: Undefined Security Weakness
Multiple PHP remote file inclusion vulnerabilities in Advanced Guestbook 2.4.2 allow remote attackers to execute arbitrary PHP code via a URL in the includepath parameter to 1 index.php, 2 addentry.php, or 3 picture.php, a different set of vectors than CVE-2006-5804. NOTE: this issue has been...
Advanced Guestbook <=- 2.4.2 (include_path) Remote File Include Vulnerability
Advanced Guestbook =- 2.4.2 includepath Remote File Include Vulnerability Script: Advanced Guestbook Version: 2.4.2 URL: http://proxy2.de/js/dl86d7a2.php Found By : BorN To K!LL Bug in : index.php , addentry.php , picture.php code :. requireonce $includepath."/admin/config.inc.php"; requireonce...
CVE-2006-3616
Multiple cross-site scripting XSS vulnerabilities in Carbonize Lazarus Guestbook 1.6 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the show parameter in codes-english.php and 2 the img parameter in picture.php, after the name of an existing file...
CVE-2006-3616
Multiple cross-site scripting XSS vulnerabilities in Carbonize Lazarus Guestbook 1.6 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the show parameter in codes-english.php and 2 the img parameter in picture.php, after the name of an existing file...
CVE-2006-3616: Undefined Security Weakness
Multiple cross-site scripting XSS vulnerabilities in Carbonize Lazarus Guestbook 1.6 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the show parameter in codes-english.php and 2 the img parameter in picture.php, after the name of an existing file...
Lazarus Guestbook Cross Site Scripting Vulnerabilities
Produce : Lazarus Guestbook Website : http://carbonize.co.uk/Lazarus/ Version : = 1.6 Problem : Cross Site Scripting 1 The first probleme is in codes-english.php ,"show" parameter in lang/codes-english.php isn't properly sanitised This can be exploited to execute arbitrary HTML and javascript cod...
CVE-2006-3283
SQL injection vulnerability in Dating Agent PRO 4.7.1 allows remote attackers to execute arbitrary SQL commands via the 1 pid parameter in picture.php, 2 mid parameter in mem.php, and the 3 sex and 4 relationship parameters in search.php...
CVE-2006-3283
SQL injection vulnerability in Dating Agent PRO 4.7.1 allows remote attackers to execute arbitrary SQL commands via the 1 pid parameter in picture.php, 2 mid parameter in mem.php, and the 3 sex and 4 relationship parameters in search.php...
CVE-2006-3283: Undefined Security Weakness
SQL injection vulnerability in Dating Agent PRO 4.7.1 allows remote attackers to execute arbitrary SQL commands via the 1 pid parameter in picture.php, 2 mid parameter in mem.php, and the 3 sex and 4 relationship parameters in search.php...
CVE-2006-2041: Undefined Security Weakness
PhpWebGallery before 1.6.0RC1 allows remote attackers to obtain arbitrary pictures via a request to picture.php without specifying the cat parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information...
[SA19801] PhpWebGallery "picture.php" Disclosure of Arbitrary Pictures
TITLE: PhpWebGallery "picture.php" Disclosure of Arbitrary Pictures SECUNIA ADVISORY ID: SA19801 VERIFY ADVISORY: http://secunia.com/advisories/19801/ CRITICAL: Less critical IMPACT: Security Bypass, Exposure of sensitive information WHERE: From remote SOFTWARE: PhpWebGallery 1.x...
PHPWebGallery Multiple Cross Site Scripting Vulnerabilities
Title : PHPWebGallery Multiple Cross Site Scripting Vulnerabilities Author: Mourad aka Psych0 root at linuxmail org Moroccan Security Team Vendor: www.phpwebgallery.net Software: PHPWebGallery Version: 1.4.1 category.php and picture.php scripts are vulnerable to XSS attacks. Exploits:...