Expinion.net Member Management System 2.1 - 'error.asp?err' Cross-Site Scripting

source: https://www.securityfocus.com/bid/9932/info It has been reported that a number of Member Management System scripts are prone to cross-site scripting vulnerabilities. These issues are reportedly due to a failure to sanitize user input and so allow HTML and script code that may facilitate...

ShopCartCGI Multiple Script Traversal Arbitrary File Access

The remote host is running ShopCartCGI - a set of CGIs designed to set up an on-line shopping cart. The version of ShopCartCGI on the remote host fails to sanitize input to several of its CGI scripts before using it to read and display files. An unauthenticated, remote attacker can leverage these...

PHPGedView 2.5/2.6 - 'Placelist.php' SQL Injection

source: https://www.securityfocus.com/bid/11910/info It is reported that PhpGedView is susceptible to a remote SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input prior to including it in an SQL query. This issue allows remote...

PHPGedView 2.52.6 - Relationship.php Cross-Site Scripting

PHPGedView 2.52.6 - Relationship.php Cross-Site Scripting source: https://www.securityfocus.com/bid/11906/info It is reported that PhpGedView is affected by a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input. This...

Synkron.Web 3.0 - HTML Injection

Synkron.Web 3.0 - HTML Injection source: https://www.securityfocus.com/bid/7833/info Synkron.web is prone to HTML injection attacks. The vulnerability exists in the search script and is a result of insufficient sanitization of malicious HTML code from user-supplied input. HTML and script code may...

W-Agora 4.1.6 - modules.php?File Traversal Arbitrary File Access

W-Agora 4.1.6 - modules.php?File Traversal Arbitrary File Access source: https://www.securityfocus.com/bid/6595/info A file disclosure vulnerability has been reported for W-Agora. It has been reported that W-Agora does not adequately sanitize some user-supplied input. An attacker can construct a...

PHP-Wiki 1.21.3 - Cross-Site Scripting

PHP-Wiki 1.21.3 - Cross-Site Scripting source: https://www.securityfocus.com/bid/5254/info PHP-Wiki does not sufficiently sanitize HTML from URI parameters, making it prone to cross-site scripting attacks. An attacker may exploit this condition by enticing users to visit a malicious link which...

Leif M. Wright simplestguest.cgi 2.0 - Remote Command Execution

Leif M. Wright simplestguest.cgi 2.0 - Remote Command Execution source: https://www.securityfocus.com/bid/2106/info A vulnerabiliy exists in Leif M. Wright's simplestguest.cgi, a script designed to coordinate guestbook submissions from website visitors. An insecure call to the open function leads...