CVE-2008-3303: Undefined Security Weakness

admin/login.php in BilboBlog 0.2.1, when registerglobals is enabled, allows remote attackers to bypass authentication and obtain administrative access via a direct request that sets the login, adminlogin, password, and adminpasswd parameters...

CVE-2008-2864: Exposure of Sensitive Information to an Unauthorized Actor

eLineStudio Site Composer ESC 2.6 and earlier allows remote attackers to obtain sensitive information via a direct request to 1 trigger.asp or 2 common2.asp in cms/include/, which reveals the database path...

CVE-2008-1680: Exposure of Sensitive Information to an Unauthorized Actor

PHP-Nuke Platinum 7.6.b.5 allows remote attackers to obtain configuration information via a direct request to maintenance/index.php, which reveals settings such as magicquotesgpc...

CVE-2008-1506: Exposure of Sensitive Information to an Unauthorized Actor

PEEL, possibly 3.x and earlier, allows remote attackers to obtain configuration information via a direct request to phpinfo.php, which calls the phpinfo function...

CVE-2008-1327: Improper Authentication

Gallarific does not require authentication for 1 users.php and 2 index.php, which allows remote attackers to add and edit tasks via a direct request. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-1181: Exposure of Sensitive Information to an Unauthorized Actor

Juniper Networks Secure Access 2000 5.5 R1 build 11711 allows remote attackers to obtain sensitive information via a direct request for remediate.cgi without certain parameters, which reveals the path in an "Execute failed" error message...

CVE-2008-0982: Improper Input Validation

Spyce - Python Server Pages PSP 2.1.3 allows remote attackers to obtain sensitive information via a direct request for spyce/examples/automaton.spy, which reveals the path in an error message...

CVE-2003-1541: Undefined Security Weakness

PlanetMoon Guestbook tr3.a stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the admin script password, and other passwords, via a direct request to files/passwd.txt...

Cross site request forgery (csrf)

HTTP File Server HFS before 2.2c tags HTTP request log entries with the username sent during HTTP Basic Authentication, regardless of whether authentication succeeded, which might make it more difficult for an administrator to determine who made a remote request...

CVE-2008-0149: Undefined Security Weakness

TUTOS 1.3 allows remote attackers to read system information via a direct request to php/admin/phpinfo.php, which calls the phpinfo function...

CVE-2008-0136: Exposure of Sensitive Information to an Unauthorized Actor

Snitz Forums 2000 3.4.05 allows remote attackers to obtain sensitive information via a direct request to forum/whereami.asp, which reveals the database path...

CVE-2008-0135: Undefined Security Weakness

Snitz Forums 2000 3.4.06 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for forum/snitzforums2000.mdb...

CVE-2007-6607: Exposure of Sensitive Information to an Unauthorized Actor

OpenBiblio 0.5.2-pre4 and earlier allows remote attackers to obtain sensitive information via a direct request for 1 shared/footer.php, 2 circ/mbrfields.php, or 3 admin/custommarcformfields.php, which reveals the path in various error messages...

CVE-2007-6603: Undefined Security Weakness

Hot or Not Clone has insufficient access control for producing and reading database backups, which allows remote attackers to obtain the administrator username and password via a direct request to control/backup/backup.php, which generates a backup/dump/backup.sql file that can be downloaded via ...

CVE-2007-6497: Undefined Security Weakness

Hosting Controller 6.1 Hot fix 3.3 and earlier 1 allows remote attackers to change arbitrary user profiles via a request to Hosting/Addreseller.asp with modified loginname and email parameters; and 2 allows remote authenticated users to change a credit amount and increase a discount via an...

CVE-2007-6395: Undefined Security Weakness

Flat PHP Board 1.2 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain credentials via a direct request for the username php file for any user account in users/...

CVE-2007-5942: Undefined Security Weakness

Bandersnatch 0.4 allows remote attackers to obtain sensitive information via a malformed request for index.php with 1 a certain func parameter value; or 2 certain func, jid, page, and limit parameter values; which reveals the path in various error messages...

CVE-2007-5787: Undefined Security Weakness

Micro Login System 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a file containing a password via a direct request for userpwd.txt...

CVE-2002-2356: Undefined Security Weakness

HAMweather 2.x allows remote attackers to modify administrative settings and obtain sensitive information via a direct request to hwadmin.cgi...

CVE-2003-1403: Improper Input Validation

foo.php3 in DotBr 0.1 allows remote attackers to obtain sensitive information via a direct request, which calls the phpinfo function...