CVE-2007-1177

WebAPP before 0.9.9.5 does not properly filter certain characters in contexts related to 1 the query string, 2 Profiles, 3 the Forum Post icon field, 4 the Edit Profile, and 5 the Gallery, which has unknown impact and remote attack vectors, possibly related to cross-site scripting XSS...

CVE-2006-2498

Invision Power Board IPB before 2.1.6 allows remote attackers to execute arbitrary PHP script via attack vectors involving 1 the posticon variable in classes/post/classpost.php and 2 the df value in actionpublic/moderate.php...

Splatt Forum html injection code in post icon

Any user can inject html code when create a new post. The bug are in the post icon: img src="icon.gif" etc. If you create a personalized form with this code: icon.gif"scriptalert'bug';scriptany tag=" the final code of the post icon is: img src="icon.gif"scriptalert'bug';scriptany tag="" etc. The...