1001 matches found
CVE-2007-3592
PM.php in Elite Bulletin Board before 1.0.10 allows remote authenticated users to delete arbitrary PM messages and conduct other attacks via modified id fields...
Code injection
PM.php in Elite Bulletin Board before 1.0.10 allows remote authenticated users to delete arbitrary PM messages and conduct other attacks via modified id fields...
CVE-2007-3592
PM.php in Elite Bulletin Board before 1.0.10 allows remote authenticated users to delete arbitrary PM messages and conduct other attacks via modified id fields...
otscms-multi.txt
Coding 4 Fun Name = OTSCMS 2.1.5 by Wrzasq http://otscms.com ; Class = Sql Injection / XSS ; Download = http://sourceforge.net/project/showfiles.php?groupid=145557 ; Found by = GregStar gregstaratc4f.pl http://c4f.pl ;...
otscms 2.1.5 - SQL Injection / Cross-Site Scripting
Coding 4 Fun Name = OTSCMS 2.1.5 by Wrzasq http://otscms.com ; Class = Sql Injection / XSS ; Download = http://sourceforge.net/project/showfiles.php?groupid=145557 ; Found by = GregStar gregstaratc4f.pl http://c4f.pl ;...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in index.php in Simple Machines Forum SMF 1.1 RC3 allow remote authenticated users to inject arbitrary web script or HTML via the 1 recipient or 2 BCC field when selecting send in a pm action...
CVE-2006-6283
CVE-2006-6283 affects Vikingboard 0.1.2 with multiple cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary script/HTML via the subject field of private messages or bulletin board posts. The initial description specifies the affected vectors as the subject fie...
PT-2006-5230 · Phlymail · Phlymail Lite
Name of the Vulnerable Software and Affected Versions: PHlyMail Lite versions 3.4.4 and earlier Description: A remote file inclusion issue allows attackers to execute arbitrary PHP code via a URL in the PM pathhandler parameter. This is a different attack vector. Note that this issue has been...
Invision Power Board 2.1.5 - from_contact SQL Injection
Invision Power Board 2.1.5 - fromcontact SQL Injection !/usr/bin/perl IPB =2.1.4 exploit possibly 2.1.5 too Brought to you by the Ykstortion security team. The bug is in the pm system so you must have a registered user. The exploit will extract a password hash from the forum's data base of the...
Invision Power Board <= 2.1.5 (from_contact) SQL Injection Exploit
Exploit for unknown platform in category web applications ================================================================== Invision Power Board = 2.1.5 fromcontact SQL Injection Exploit ================================================================== !/usr/bin/perl IPB =2.1.4 exploit possibly...
CVE-2006-2097
SQL injection vulnerability in funcmsg.php in Invision Power Board IPB 2.1.4 allows remote attackers to execute arbitrary SQL commands via the fromcontact field in a private message PM...
CVE-2006-2097
SQL injection vulnerability in funcmsg.php in Invision Power Board IPB 2.1.4 allows remote attackers to execute arbitrary SQL commands via the fromcontact field in a private message PM...
ibp-2.1.4-xpl.txt
This exploit has only been tested on 2.1.4. Others are most likely vulnerable but have not yet been tested. Simple SQL injection in funcmsg.php on line 448. tobyid is not properly sanitized. It's passed to the class via an instance of the messenger class, which takes it from the ipb sanitized inp...
SQL injection exploit IPB <= 2.1.4
This exploit has only been tested on 2.1.4. Others are most likely vulnerable but have not yet been tested. Simple SQL injection in funcmsg.php on line 448. tobyid is not properly sanitized. It's passed to the class via an instance of the messenger class, which takes it from the ipb sanitized inp...
CVE-2005-3777
MyBB 1.0 PR2 Rev 686 is affected by a vulnerability that allows remote attackers to delete or move private messages (PM) by submitting modified fields in the inbox form. The provided documents confirm the affected software and the manipulation vector, but do not specify root cause details beyond ...
CVE-2005-0878
Cross-site scripting XSS vulnerability in MercuryBoard before 1.1.3 allows remote attackers to inject arbitrary web script or HTML via the title field of a PM private message...
CVE-2005-0878
MercuryBoard before 1.1.3 is affected by CVE-2005-0878: an XSS flaw in the title field of private messages that lets remote attackers inject arbitrary script/HTML. Root cause: insufficient input sanitization in the PM title. Impact: could compromise user sessions or integrity of rendered pages as...
CVE-2005-0878
Cross-site scripting XSS vulnerability in MercuryBoard before 1.1.3 allows remote attackers to inject arbitrary web script or HTML via the title field of a PM private message...
CVE-2005-0631
CVE-2005-0631 affects PBLang BBS (version around 4.63) with a vulnerability in delpm.php where a logged-in, remote user can delete arbitrary personal messages by altering the id and a parameters. The issue stems from improper handling of these parameters, enabling unauthorized PM deletion within ...
HRG009.txt
HRG - Hackerlounge Research Group Release: HRG009 Monday 03/01/05 Software PBLang 4.63 delpm.php authentication problem The author can't be held responsible for any damage done by a reader. You have your own resonsibility Please use this document like it's meant to. Vulnerable: PBLang 4.63 and...