OpenBB < 1.0.9 Multiple Vulnerabilities

The remote host seems to be running OpenBB, a forum management system written in PHP. The remote version of this software is vulnerable to cross-site scripting attacks, and SQL injection flaws. Using a specially crafted URL, an attacker may execute arbitrary commands against the remote SQL databa...

MyServer 0.8 Multiple Vulnerabilities

The remote host is running MyServer, an open source http server. This version is vulnerable to a directory listing flaw and cross-site scripting. An attacker can execute a cross-site scripting attack, or gain knowledge of certain system information of the server. %NASLMINLEVEL 70300 C Tenable...

PwsPHP profil.php id Parameter XSS

The remote host runs PWSPHP Portail Web System a CMS written in PHP. The remote version of this software is vulnerable to cross-site scripting attack due to a lack of sanity checks on the 'skin' parameter in the script SettingsBase.php. With a specially crafted URL, an attacker could use the remo...

CVE-2005-0158

Format string vulnerability in bidwatcher before 1.3.17 allows remote malicious web servers from eBay, or a spoofed eBay server, to cause a denial of service and possibly execute arbitrary code via certain responses...

IMP common-footer.inc Parent Frame Page Title XSS

According to its version, the remote installation of IMP fails to fully sanitize user-supplied input when setting the parent frame's page title by JavaScript in 'templates/common-footer.inc'. By leveraging this flaw, an attacker may be able to inject arbitrary HTML and script code into a user's...

DUPortal/DUPortal Pro Multiple Scripts SQL Injection (1)

The remote host is running DUPortal, a content management system written in ASP. The remote version of this software is vulnerable to several SQL injection vulnerabilities in files 'details.asp', 'search.asp', 'default.asp' , 'cat.asp' and more. With a specially crafted URL, an attacker can explo...

ASP PortalApp Multiple SQL Injection

The remote host is running ASP PortalApp, a web application software written in ASP. There is a flaw in the remote software that could allow anyone to inject arbitrary SQL commands, which could in turn be used to gain administrative access on the remote host. In addition, a path disclosure and...

Horde Parent Frame Page Title XSS

The version of Horde installed on the remote host suffers from a cross-site scripting vulnerability in which an attacker can inject arbitrary HTML and script code via the page title of a parent frame, enabling him to steal cookie-based authentication credentials and perform other such attacks...

CVE-2002-1647

The quick login feature in Slash Slashcode does not redirect the user to an alternate URL when the wrong password is provided, which makes it easier for remote web sites to guess the proper passwords by reading the username and password from the Referrer URL...

CVE-2002-1647

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2005-0800

PHP remote file inclusion vulnerability in install.php in mcNews 1.3 and earlier allows remote attackers to execute arbitrary PHP code by modifying the l parameter to reference a URL on a remote web server that contains the code, a different vulnerability than CVE-2005-0720...

UBB.threads editpost.php Number Parameter SQL Injection

According to its banner, the remote host is running a version of UBB.threads that fails to sufficiently sanitize the 'Number' parameter before using it in SQL queries in the 'editpost.php' script. As a result, a remote attacker can pass malicious input to database queries, potentially resulting i...

paNews Detection

The remote host is running paNews, a news management application written in PHP. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include"compat.inc"; if description scriptid17253; scriptversion"1.18"; scriptsetattributeattribute:"pluginmodificationdate",...

PunBB < 1.2.2 Multiple Input Validation Vulnerabilities

The remote host is running a version of PunBB that fails to properly sanitize user-input to several scripts thereby enabling an attacker to launch various SQL injection attacks. In addition, the profile.php script enables anyone to call the changepass action while specifying the id of an existing...

phpWebSite Detection

The remote host is running phpWebSite, a website content management system written in PHP. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid17222; scriptversion"1.21"; scriptsetattributeattribute:"pluginmodificationdate", value:"2023/05/24"; scriptnameenglish:"phpWebSi...

BizMail bizmail.cgi Arbitrary Mail Relay

The remote web server is hosting the CGI bizmail.cgi, a CGI script for sending the content of web forms to email addresses. The remote version of this software fails to sanitize the 'email' parameter to the 'bizmail.cgi' script of CRLF sequences. An unauthenticated, remote attacker may be able to...

Horde < 3.0.1 Multiple Script XSS

The remote host is running at least one instance of Horde version 3.0, which suffers from two cross-site scripting vulnerabilities. Through specially crafted GET requests to the remote host, an attacker can cause a third-party user to unknowingly run arbitrary JavaScript code. %NASLMINLEVEL 70300...

FlatNuke index.php url_avatar Field Arbitrary PHP Code Execution

The remote host is running FlatNuke, a content management system written in PHP and using flat files rather than a database for its storage. The remote version of this software has a form submission vulnerability that may allow an attacker to execute arbitrary PHP commands on the remote host...

Ikonboard ikonboard.cgi Multiple Parameter SQL Injection

The remote server is running IkonBoard, a Web Bulletin Board System written in Perl. The remote version of this software fails to sanitize user-supplied input to multiple variables in the 'ikonboard.cgi' script. An attacker can exploit this flaw to launch SQL injection attacks. %NASLMINLEVEL 7030...

phpGroupWare Detection

The remote host is running PHPGroupWare, a groupware system written in PHP. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid15982; scriptversion"1.19"; scriptsetattributeattribute:"pluginmodificationdate", value:"2022/06/01"; scriptnameenglish:"phpGroupWare Detection"...