JAFCMS-4.0.txt

Hacker: NanoyMaster /|| \ | || \ / ||\ Exploit: JAF CMS / || |\| || / || \ Version: 4.0 RC1 \ || | \ || |/| || / ||| ||| |||/ vulnerabilities: XSS in shoutbox PHP execution XSS in forum \m/Props\m/ z3r0phr34k SystemMeltdown THK-GEO & THK-h3x All of Exploitarians...

CVE-2006-5117

phpMyAdmin before 2.9.1-rc1 has a libraries directory under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information via direct requests for certain files...

CVE-2006-5129

CVE-2006-5129 affects ph03y3nk just another flat file (JAF) CMS 4.0 RC1. The vulnerabilities are cross-site scripting in two spots: (1) module/shout/jafshout.php (the shoutbox) via the message parameter and related name/email/title/date/ldate/lname variables, and (2) the message body in a forum p...

JVN#65677118 Pixelpost cross-site scripting vulnerability

Impact An arbitrary script may be executed on the user's web browser. In addition, if session information from a cookie is leaked, session hijacking could be conducted. Solution Products Affected Pixelpost 1.5 RC1-2 and earlier...

Remote Include Vulnerability ====> in Dr.Jr7 Gallery 3.2 RC1

TitLe : Remote Include Vulnerability ==== in Dr.Jr7 Gallery 3.2 RC1 eXpLoIt : http://target/path/Galleryone/Gallery.php?pic=shell.txt By : R0t-KeY --- s33 u ;...

CVE-2006-3847

PHP remote file inclusion vulnerability in 1 admin.php, and possibly 2 details.php, 3 modify.php, 4 newgroup.php, 5 newtask.php, and 6 rss.php, in MoSpray aka commospray 1.8 RC1 allows remote attackers to execute arbitrary PHP code via a URL in the basedir parameter...

CVE-2006-3847

CVE-2006-3847: PHP remote file inclusion in MoSpray (aka com_mospray) 1.8 RC1. The vulnerability affects basedir handling in multiple scripts (admin.php, and possibly details.php, modify.php, newgroup.php, newtask.php, rss.php), allowing an attacker to cause arbitrary PHP code execution via a URL...

CVE-2006-3273

Cross-site scripting XSS vulnerability in menu.php in Some Chess 1.5 rc1 allows remote attackers to inject arbitrary web script or HTML via the user parameter "New Name" field...

CVE-2006-3273

The CVE-2006-3273 entry documents a Cross-site Scripting (XSS) vulnerability in menu.php of Some Chess 1.5 rc1, exploitable via the user parameter in the “New Name” field. The affected component is menu.php within Some Chess 1.5 rc1; the underlying cause is input that is not properly sanitized, e...

Mambo <= 4.6. RC1 xss

Mambo = 4.6. RC1 Cross Site Scripting --------------------------------------- http://target/pathtomambo/administrator/popups/index3pop.php?mosConfigsitename=/titlescriptalertdocument.cookie/script...

CVE-2006-2524

Cross-site scripting XSS vulnerability in UseBB 1.0 RC1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors when processing the user date format...

CVE-2006-2524

CVE-2006-2524 is an XSS vulnerability in UseBB 1.0 RC1 and earlier . The issue allows remote attackers to inject arbitrary script/HTML via unspecified vectors when processing the user date format. According to NVD, the CVSSv2 base score is 6.8 (Medium) with partial confidentiality, integrity, and...

CVE-2006-1522

The sysaddkey function in the keyring code in Linux kernel 2.6.16.1 and 2.6.17-rc1, and possibly earlier versions, allows local users to cause a denial of service OOPS via keyctl requests that add a key to a user key instead of a keyring key, which causes an invalid dereference in the...

Design/Logic Flaw

PHP before 5.1.3-RC1 might allow remote attackers to obtain portions of memory via crafted binary data sent to a script that processes user input in the htmlentitydecode function and sends the encoded results back to the client, aka a "binary safety" issue. NOTE: this issue has been referred to a...

CVE-2005-4613

Technical details for CVE-2005-4613 are not publicly available in the provided documents; the materials include only a general description of an XSS issue in VUBB alpha rc1. Monitor for updates.

CVE-2005-4612

VULNERABILITY SUMMARY (CVE-2005-4612) : The affected software is VUBB alpha rc1. It contains multiple SQL injection vulnerabilities in three entry points: viewforum.php (parameter f), viewtopic.php (parameter t), and usercp.php (parameter view). The underlying issue is improper handling of user-s...

CVE-2005-4612

Multiple SQL injection vulnerabilities in VUBB alpha rc1 allow remote attackers to execute arbitrary SQL commands via the 1 f parameter to viewforum.php, 2 t parameter to viewtopic.php, and 3 view parameter to usercp.php...

CVE-2005-4489

Cross-site scripting XSS vulnerability in Scoop 1.1 RC1 and earlier allows remote attackers to inject arbitrary web script or HTML via the 1 type and 2 count parameters, and 3 the query string in a story...

CVE-2005-4489

CVE-2005-4489 describes a Cross-site Scripting (XSS) vulnerability in Scoop 1.1 RC1 and earlier, where remote attackers can inject arbitrary web script or HTML via the (1) type, (2) count parameters, and (3) the query string in a story. Affected product is Scoop (version 1.1 RC1 and earlier); und...

Scoop 1.1 RC1 Search Module - Multiple Cross-Site Scriptings

Scoop 1.1 RC1 Search Module - Multiple Cross-Site Scriptings source: https://www.securityfocus.com/bid/16014/info Scoop is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverag...