3625 matches found
CVE-2006-4551
Eval injection vulnerability in CHXO Feedsplitter 2006-01-21 allows remote attackers to execute arbitrary PHP code via 1 the file specified as the value of the format parameter, and possibly 2 the RSS feed...
CVE-2006-4552
The CVE-2006-4552 entry concerns CHXO Feedsplitter (RSS/RDF feed converter) with a cross-site scripting flaw. The Feedsplitter component (feedsplitter.php) processes the format parameter when parsing an XML feed, and improper validation allows a remote attacker to inject arbitrary script via a fe...
CVE-2006-4552
Cross-site scripting XSS vulnerability in CHXO Feedsplitter 2006-01-21 allows remote attackers to inject arbitrary web script or HTML via the RSS feed...
feedsplitter considered harmful
I was looking through the feedsplitter.php script avaiable from http://chxo.com/software/feedsplitter/, version 2006-01-21 revision 1.7 according to the RCS $Id$, but that looks out of date today, and noticed a few problems. Background: feedsplitter turns RSS feeds into HTML or javascript so you...
Feedsplitter <= 2006-01-21 Multiple Remote Vulnerabilities (XSS, Traversal, Disc)
The remote host is running Feedsplitter, a PHP script for converting RSS / RDF feeds into HTML. The version of Feedsplitter installed on the remote host fails to properly validate the 'format' parameter of the 'feedsplitter.php' script before using it to parse an arbitrary XML file. An...
iziContents <= RC6 GLOBALS[] Remote Code Execution Exploit
Exploit for unknown platform in category web applications ========================================================== iziContents include/rssfunctions.php line 32-40: .... $GLOBALS"rootdp" = './'; requireonce $GLOBALS"rootdp"."include/config.php"; requireonce $GLOBALS"rootdp"."include/db.php";...
CVE-2006-3182
Directory traversal vulnerability in index.php in MobeScripts Mobile Space Community 2.0 allows remote attackers to read arbitrary files via a .. dot dot in the uid parameter in the rss page...
lifetype_104_sql.txt
!/usr/bin/php -q -d shortopentag=on 126 $result.=" ."; else $result.=" ".$string$i; if strlendechexord$string$i==2 $exa.=" ".dechexord$string$i; else $exa.=" 0".dechexord$string$i; $cont++;if $cont==15 $cont=0; $result.="\r\n"; $exa.="\r\n"; return $exa."\r\n".$result; $proxyregex =...
CVE-2006-2725
Eggblog vulnerable to SQL injection in rss/posts.php (
mybb v1.1.1(rss.php) SQL Injection Exploit
---------------------------------- Foud By: Breeeeh & CrAzY CrAcKeR Site: www.alshmokh.com Email:[email protected] ---------------------------------- $query = $db-query"SELECT FROM ".TABLEPREFIX."forums f WHERE 1=1 $forumlist"; $comma = " - "; while$forum = $db-fetcharray$query $title .=...
CVE-2006-2420
Bugzilla 2.20rc1 through 2.20 and 2.21.1, when using RSS 1.0, allows remote attackers to conduct cross-site scripting XSS attacks via a title element with HTML encoded sequences such as "", which are automatically decoded by some RSS readers. NOTE: this issue is not in Bugzilla itself, but rather...
CVE-2006-2420
Bugzilla 2.20rc1 through 2.20 and 2.21.1, when using RSS 1.0, allows remote attackers to conduct cross-site scripting XSS attacks via a title element with HTML encoded sequences such as "", which are automatically decoded by some RSS readers. NOTE: this issue is not in Bugzilla itself, but rather...
Cross site scripting
Bugzilla 2.20rc1 through 2.20 and 2.21.1, when using RSS 1.0, allows remote attackers to conduct cross-site scripting XSS attacks via a title element with HTML encoded sequences such as "", which are automatically decoded by some RSS readers. NOTE: this issue is not in Bugzilla itself, but rather...
CVE-2006-2420
CVE-2006-2420 affects Bugzilla 2.20rc1 through 2.20 and 2.21.1 when using RSS 1.0, enabling remote XSS via a title element containing HTML-encoded sequences (e.g., ">") that are decoded by some RSS readers. The issue is described as stemming from RSS design/documentation inconsistencies or RSS...
CVE-2006-2420
Bugzilla 2.20rc1 through 2.20 and 2.21.1, when using RSS 1.0, allows remote attackers to conduct cross-site scripting XSS attacks via a title element with HTML encoded sequences such as "", which are automatically decoded by some RSS readers. NOTE: this issue is not in Bugzilla itself, but rather...
PT-2006-2940 · Joomla +1 · Joomla! +1
Name of the Vulnerable Software and Affected Versions: Mambo affected versions not specified Joomla! affected versions not specified Description: The issue allows remote attackers to obtain sensitive information via an invalid feed parameter, which reveals the path in an error message. This is...
[KAPDA::#41] - Mambo/Joomla rss component vulnerability
KAPDA New advisory Mambo website : http://www.mamboserver.com Bug: Path Disclosure & Remote Denial Of Service Exploitation: Remote with browser Exploit: available Description: -------------------- Mambo is a feature-rich dynamic portal engine/content management tool capable of building sites from...
Simplog <= 0.9.2 (s) Remote Commands Execution Exploit
No description provided by source. !/usr/bin/php -q -d shortopentag=on ? echo "Simplog = 0.9.2 "s" remote cmmnds xctn\r\n"; echo "by rgod [email protected]\r\n"; echo "site: http://retrogod.altervista.org\r\n\r\n"; echo "dork: intext:"Powered by simplog"\r\n\r\n"; if $argc5 echo "Usage: php...
RedBLoG 0.5 - 'cat_id' SQL Injection
x128.net oo website : www.x128.net"; function xssexploit $xsstarget = $SERVER'argv'1 . "/modules/blog/rss.php"; $xsshttpget = "?catid=x128"; $xssconnection = curlinit; if $SERVER'argv'2...
RedBLoG 0.5 - cat_id SQL Injection
RedBLoG 0.5 - catid SQL Injection x128.net oo website : www.x128.net"; function xssexploit $xsstarget = $SERVER'argv'1 . "/modules/blog/rss.php"; $xsshttpget = "?catid=x128"; $xssconnection = curlinit;...