CVE-2007-1636

Directory traversal vulnerability in index.php in RoseOnlineCMS 3 B1 allows remote attackers to include arbitrary files via a .. dot dot sequence in the op parameter, as demonstrated by injecting PHP code into Apache log files via the URL and User-Agent HTTP header...

CVE-2007-1524

CVE-2007-1524 affects ZomPlog up to version 3.7.6, specifically the themes/default/ handling. The vulnerability is a directory traversal flaw where an attacker can use the settings[skin] parameter to include local files; by injecting PHP code into an Apache log file, that code can be included via...

CVE-2007-1405

Cross-site scripting XSS vulnerability in the "download wiki page as text" feature in Trac before 0.10.3.1, when Microsoft Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters...

CVE-2007-1241

CVE-2007-1241 is an XSS vulnerability reported in Audins Audiens 3.3, specifically in setup.php, exploitable through PATH_INFO to inject arbitrary script/HTML. Concretely, multiple sources (NVD, CVE lists, Prion, Vulners) describe the same issue; the root cause is not elaborated beyond the PATH_I...

CVE-2006-7023

CVE-2006-7023 concerns FX-APP 0.0.8.1 with multiple XSS vulnerabilities allowing remote injection of HTML/script via profile fields (search box, url, website, comment, signature) and possibly a menu item. According to NVD, the CVSS2 base score is 4.3 (Network attack, Medium complexity, no authent...

CVE-2007-0768

CVE-2007-0768 affects Yahoo! Messenger

CVE-2007-0407

CVE-2007-0407 describes a cross-site scripting (XSS) vulnerability in Plain Black WebGUI, specifically in Operation/User.pm for versions before 7.3.5 (beta). The issue arises from accepting a username during anonymous registration, allowing an attacker to inject arbitrary web script or HTML. The ...

CVE-2006-4576

Cross-site scripting XSS vulnerability in The Address Book 1.04e allows remote attackers to inject arbitrary web script or HTML by uploading the HTML file with a GIF or JPG extension, which is rendered by Internet Explorer...

CVE-2006-6768

The CVE-2006-6768 entry documents multiple XSS vulnerabilities in the default.asp page of PWP Technologies The Classified Ad System, exploitable via the (1) cat and (2) main parameters. The underlying issue is cross-site scripting in input handling on that page, with a CVSS base score of 6.8 (Med...

CVE-2006-6704

Cross-site scripting XSS vulnerability in the Webadmin in @Mail before 4.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving "unescaped data in the database."...

CVE-2006-6544

The CVE-2006-6544 entry describes a Cross-site scripting (XSS) vulnerability in CM68 News that allows remote attackers to inject arbitrary script or HTML via unspecified vectors. Affected software is CM68 News; the exact component/file and vulnerable version(s) are not explicitly stated in the pr...

CVE-2006-6393

Cross-site scripting XSS vulnerability in Jonas Gauffin Publicera 1.0-rc2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the InputFilter::getString function...

CVE-2006-6159

CVE-2006-6159 describes multiple cross-site scripting (XSS) vulnerabilities in DeskPRO 2.0.0 and 2.0.1, exploitable via the message or subject parameters in newticket.php. The underlying issue is that remote attackers can inject arbitrary web script or HTML. The CVSS basis is 6.8 (Medium), with n...

CVE-2006-5799

CVE-2006-5799 involves multiple XSS vulnerabilities in the xenis.creator CMS, specifically in default.asp where the (1) contid and (2) search parameters can be exploited to inject arbitrary web script/HTML. Documented impact is partial confidentiality/integrity/availability, with a NVD CVSS v2 ba...

CVE-2006-5661

CVE-2006-5661 is an XSS vulnerability in VIRtech Netquery’s nquser.php that allows remote attackers to inject arbitrary web script via the User-Agent header. The issue is documented across multiple feeds, with CVSS 2.0 indicating a Network attack, no authentication, and partial impact to confiden...

CVE-2006-5632

Cross-site scripting XSS vulnerability in changepass.php in iG Shop 1.4 allows remote attackers to inject arbitrary web script or HTML via the id parameter, a different vulnerability than CVE-2006-5631. NOTE: the provenance of this information is unknown; the details are obtained solely from thir...

CVE-2006-5515

Cross-site scripting XSS vulnerability in lib-history.inc.php in phpAdsNew and phpPgAds before 2.0.8-pr1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to injected data that is stored by a delivery script and displayed by the admin interface...

CVE-2006-5203

Invision Power Board IPB 2.1.7 and earlier allows remote restricted administrators to inject arbitrary web script or HTML, or execute arbitrary SQL commands, via a forum description that contains a crafted image with PHP code, which is executed when the user visits the "Manage Forums" link in the...

CVE-2006-5190

CVE-2006-5190 affects osCommerce 2.2 Milestone 2 Update 060817. The vulnerability is a set of multiple XSS flaws exploitable through the page parameter in admin scripts (banner_manager.php, banner_statistics.php, countries.php, currencies.php, languages.php, manufacturers.php, newsletters.php, or...

CVE-2006-5146

Multiple cross-site scripting XSS vulnerabilities in Yblog allow remote attackers to inject arbitrary web script or HTML via the 1 id parameter in a funk.php, or the 2 action parameter in b tem.php and c uss.php...