CVE-2006-2281

X-Scripts X-Poll (xpoll) 2.30 is affected by an RCE via admin/images/add.php: an attacker can upload a PHP file and access it remotely. The underlying issue is improper file upload handling that allows execution of arbitrary PHP code. This affects the product as described in CVE-2006-2281 and is ...

CVE-2006-2281

X-Scripts X-Poll xpoll 2.30 allows remote attackers to execute arbitrary PHP code by using admin/images/add.php to upload a PHP file, then access it...

X-POLL admin By-Pass

google dork: inurl:x-poll and add to /admin/images/add.php , upload to shell, and mass deface is server www.ayyildiz.org...

Authentication flaw

CodeMunkyX aka free-php.net Simple Poll 1.0, when authentication is not required for the admin directory, allows remote attackers to gain administrative privileges by appending /admin/ to the top-level URI of the application...

CVE-2006-2235

CodeMunkyX aka free-php.net Simple Poll 1.0, when authentication is not required for the admin directory, allows remote attackers to gain administrative privileges by appending /admin/ to the top-level URI of the application...

CVE-2006-2235

CodeMunkyX aka free-php.net Simple Poll 1.0, when authentication is not required for the admin directory, allows remote attackers to gain administrative privileges by appending /admin/ to the top-level URI of the application...

CVE-2006-2235

CVE-2006-2235 affects CodeMunkyX (free-php.net) Simple Poll 1.0. The root cause is missing authentication for the admin directory, allowing remote attackers to gain administrative privileges by appending "/admin/" to the top-level URI. The vulnerability is network-exploitable with high complexity...

freeadmin.txt

google dork:"powered by free-php.net" poll last path add to /admin/ select poll and modify or addnew poll credits:tugr@...

Design/Logic Flaw

include/classpoll.php in Advanced Poll 2.0.4 uses the HTTPXFORWARDEDFOR X-Forwarded-For HTTP header to identify the IP address of a client, which makes it easier for remote attackers to spoof the source IP and bypass voting restrictions...

Sql injection

SQL injection vulnerability in include/classpoll.php in Advanced Poll 2.0.4 allows remote attackers to execute arbitrary SQL commands via the User-Agent HTTP header...

CVE-2006-2130

SQL injection vulnerability in include/classpoll.php in Advanced Poll 2.0.4 allows remote attackers to execute arbitrary SQL commands via the User-Agent HTTP header...

CVE-2006-2131

include/classpoll.php in Advanced Poll 2.0.4 uses the HTTPXFORWARDEDFOR X-Forwarded-For HTTP header to identify the IP address of a client, which makes it easier for remote attackers to spoof the source IP and bypass voting restrictions...

CVE-2006-2131

include/classpoll.php in Advanced Poll 2.0.4 uses the HTTPXFORWARDEDFOR X-Forwarded-For HTTP header to identify the IP address of a client, which makes it easier for remote attackers to spoof the source IP and bypass voting restrictions...

CVE-2006-2130

SQL injection vulnerability in include/classpoll.php in Advanced Poll 2.0.4 allows remote attackers to execute arbitrary SQL commands via the User-Agent HTTP header...

CVE-2006-2131

The CVE-2006-2131 entry concerns Advanced Poll 2.0.4, where include/class_poll.php uses the HTTP_X_FORWARDED_FOR header to identify the client IP. The root cause is relying on X-Forwarded-For for IP checks, which allows remote attackers to spoof the source IP and bypass voting restrictions. The a...

CVE-2006-2130

The CVE-2006-2130 entry concerns a SQL injection vulnerability in Advanced Poll 2.0.4, exploitable through the User-Agent HTTP header in include/class_poll.php. The connected documents confirm affected software and the root cause is improper handling of User-Agent data, enabling remote attackers ...

free-php.net Poll 1.0 admin login

google dork:"powered by free-php.net" poll last path add to /admin/ select poll and modify or addnew poll credits:tugr@...

Sql injection

Multiple SQL injection vulnerabilities in Advanced Poll 2.02 allow remote attackers to execute arbitrary SQL commands via the 1 id parameter to comments.php or 2 pollid parameter to page.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Advanced Poll 2.02 allow remote attackers to inject arbitrary web script or HTML via the 1 id parameter to comments.php or 2 pollid parameter to page.php. NOTE: it is possible that this issue is resultant from CVE-2006-1616...

CVE-2006-1617

Multiple cross-site scripting XSS vulnerabilities in Advanced Poll 2.02 allow remote attackers to inject arbitrary web script or HTML via the 1 id parameter to comments.php or 2 pollid parameter to page.php. NOTE: it is possible that this issue is resultant from CVE-2006-1616...