Link Request Contact Form 3.4 - Remote Code Execution

-=--------------------ADVISORY-------------------=- Link Request Contact Form v3.4 Author: CorryL [email protected] -=-----------------------------------------------=- -=+ Application: Link Request Contact Form -=+ Version: 3.4 -=+ Vendor's URL:...

lrcf-inject.txt

-=--------------------ADVISORY-------------------=- Link Request Contact Form v3.4 Author: CorryL [email protected] -=-----------------------------------------------=- -=+ Application: Link Request Contact Form -=+ Version: 3.4 -=+ Vendor's URL:...

Cross site scripting

Cross-site scripting XSS vulnerability in RM EasyMail Plus allows remote attackers to inject arbitrary web script or HTML via the title field in an email...

EUVD-2007-2724

Multiple cross-site scripting XSS vulnerabilities in Jetbox CMS allow remote attackers to inject arbitrary web script or HTML via the 1 path parameter to view/search/; or the 2 companyname, 3 country, 4 email, 5 firstname, 6 middlename, 7 required, 8 surname, or 9 title parameter to...

CVE-2007-2625

CVE-2007-2625 is an XSS vulnerability in All In One Control Panel (AIOCP) prior to 1.3.016. The flaw resides in shared/code/cp_authorization.php and allows remote attackers to inject arbitrary web script or HTML via unspecified parameters. The entry notes that details are from third-party sources...

CVE-2006-7196

Cross-site scripting (XSS) vulnerability in the calendar example (cal2.jsp) of Apache Tomcat affects 4.0.0–4.0.6, 4.1.0–4.1.31, 5.0.0–5.0.30, and 5.5.0–5.5.15. An attacker can inject arbitrary script via the time parameter to cal2.jsp (and possibly other vectors). This enables script execution in...

CVE-2007-2472

CVE-2007-2472 is an XSS vulnerability in Sendcard 3.4.1 and earlier, affecting sendcard.php where the form parameter can be exploited to inject arbitrary script/HTML. The description notes the vulnerability details come from third-party sources with unknown provenance. Connected documents confirm...

CVE-2007-2245

Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin before 2.10.1.0 allow remote attackers to inject arbitrary web script or HTML via 1 the fieldkey parameter to browseforeigners.php or 2 certain input to the PMAsanitize function...

Input validation

The imagecomments function in classes.php in MiniGal b13 allows remote attackers to inject arbitrary PHP code into a file in the thumbs/ directory via the input parameter. NOTE: some of these details are obtained from third party information...

CVE-2007-2146

The imagecomments function in classes.php in MiniGal b13 allow remote attackers to inject arbitrary PHP code into a file in the thumbs/ directory via the 1 name or 2 email parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2007-2146

CVE-2007-2146 affects MiniGal b13: the imagecomments function in classes.php lets remote attackers inject arbitrary PHP code into a file under thumbs/ by supplying the name or email parameter. This is a client-controlled input vulnerability in a PHP application function, enabling code injection w...

CVE-2007-2145

The imagecomments function in classes.php in MiniGal b13 allows remote attackers to inject arbitrary PHP code into a file in the thumbs/ directory via the input parameter. NOTE: some of these details are obtained from third party information...

ShoutPro <= 1.5.2 (shout.php) Remote Code Injection Exploit

No description provided by source. ?/ File: shoutbox.php Affects: ShoutPro 1.5.2 may affect earlier versions Date: 17th April 2007 Issue Description: =========================================================================== ShoutPro 1.5.2 fails to fully sanitize user input $shout that it writes...

ShoutPro 1.5.2 - shout.php Remote Code Injection

ShoutPro 1.5.2 - shout.php Remote Code Injection ?php echo "\n"; echo " Special Greetings To - Timq,Warpboy,The-Maggot \n"; echo "\n\n\n"; //Writes Files - Under 100 bytes to meet requirements $temppayload = "...

ShoutPro <= 1.5.2 (shout.php) Remote Code Injection Exploit

Exploit for unknown platform in category web applications =========================================================== ShoutPro ?php echo "...

ShoutPro 1.5.2 - 'shout.php' Remote Code Injection

?php echo "\n"; echo " Special Greetings To - Timq,Warpboy,The-Maggot \n"; echo "\n\n\n"; //Writes Files - Under 100 bytes to meet requirements $temppayload = "%3C%3F%24a%3Dfopen%28%24POST%5B%27f%27%5D%2C%27w...

CVE-2007-1927

Cross-site scripting XSS vulnerability in signup.asp in CmailServer WebMail 5.3.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the POP3Mail parameter...

CVE-2007-1848

Cross-site scripting XSS vulnerability in admin/classes/ui.dta.php in Drake CMS allows remote attackers to inject arbitrary web script or HTML via the desctitle field. NOTE: Drake CMS has only a beta version available, and the vendor has previously stated "We do not consider security reports vali...

CVE-2006-7187

Cross-site scripting XSS vulnerability in the showrecentsearches function in cgi-lib/user-lib/search.pl in web-app.net WebAPP before 20060909 allows remote attackers to inject arbitrary web script or HTML via the srch variable...

CVE-2007-1780

The CVE-2007-1780 has concrete details across connected sources: Overlay Weaver’s DHT shell (owdhtshell) versions 0.5.9–0.5.11 are affected by a cross-site scripting (XSS) vulnerability when invoked with the -x option, allowing remote attackers to inject arbitrary web script or HTML via certain i...