OlateDownload 3.4 - search.php?query SQL Injection

OlateDownload 3.4 - search.php?query SQL Injection source: https://www.securityfocus.com/bid/20278/info OlateDownload is prone to multiple input-validation vulnerabilities, including HTML-injection and SQL-injection issues, because the application fails to properly sanitize user-supplied input. A...

Geotarget - script.php Remote File Inclusion

Geotarget - script.php Remote File Inclusion source: https://www.securityfocus.com/bid/20272/info Geotarget is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue may allow an attacker to compromise the application and t...

[MajorSecurity Advisory #28]ConPresso CMS - Multiple Cross Site Scripting and SQL Injection Issues

MajorSecurity Advisory 28ConPresso CMS - Multiple XSS and SQL Injection Issues Details ======= Product: ConPresso CMS Affected Version: =4.0.4a Immune Version: 4.0.5a Security-Risk: moderated Remote-Exploit: yes Vendor-URL: http://www.conpresso.com/ Vendor-Status: informed Advisory-Status:...

DokuWiki fetch.php Multiple Parameter imconvert Function Arbitrary Command Execution

The remote host is running DokuWiki, an open source wiki application written in PHP. The installed version of DokuWiki fails to properly sanitize input to the 'w' and 'h' parameters of the 'lib/exe/fetch.php' script before using it to execute a command when resizing images. An unauthenticated...

Buzlas 2006-1 Full - 'Archive_Topic.php' Remote File Inclusion

source: https://www.securityfocus.com/bid/20511/info Buzlas is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also...

WebNews 1.4 - parser.php Remote File Inclusion (2)

WebNews 1.4 - parser.php Remote File Inclusion 2 source: https://www.securityfocus.com/bid/20239/info Web//News is prone to a remote file-include vulnerability because the application fails to properly sanitize user-supplied input. An attacker can exploit this issue to include an arbitrary remote...

Web//News 1.4 - 'parser.php' Remote File Inclusion (2)

source: https://www.securityfocus.com/bid/20239/info Web//News is prone to a remote file-include vulnerability because the application fails to properly sanitize user-supplied input. An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute i...

vBulletin 2.3.x - global.php SQL Injection

vBulletin 2.3.x - global.php SQL Injection source: https://www.securityfocus.com/bid/20214/info vBulletin is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to...

PHP Invoice 2.2 - home.php Cross-Site Scripting

PHP Invoice 2.2 - home.php Cross-Site Scripting source: https://www.securityfocus.com/bid/20221/info PHP Invoice is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script co...

dokuwiki -- multiple vulnerabilities

Secunia reports: Some vulnerabilities have been reported in DokuWiki, which can be exploited by malicious people to cause a DoS Denial of Service or potentially compromise a vulnerable system. Input passed to the "w" and "h" parameters in lib/exec/fetch.php is not properly sanitised before being...

Phoenix Evolution CMS - 'index.php' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/20212/info Phoenix Evolution CMS is prone to multiple cross-site scripting vulnerabilities because the application fails to sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code execute in the browser of an...

CubeCart 3.0.x - '/admin/image.php?image' Cross-Site Scripting

source: https://www.securityfocus.com/bid/20215/info CubeCart is prone to multiple input-validation vulnerabilities, including information-disclosure, cross-site scripting, and SQL-injection issues, because the application fails to properly sanitize user-supplied input. A successful exploit of...

Phoenix Evolution CMS - index.php Multiple Cross-Site Scripting Vulnerabilities

Phoenix Evolution CMS - index.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/20212/info Phoenix Evolution CMS is prone to multiple cross-site scripting vulnerabilities because the application fails to sanitize user-supplied input. An attacker may...

Back-End CMS 0.4.5 - search.php?includes_path Remote File Inclusion

Back-End CMS 0.4.5 - search.php?includespath Remote File Inclusion source: https://www.securityfocus.com/bid/20207/info Back-End CMS is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input. A successful exploit of these issues allows an...

Exporia 0.3 - Common.php Remote File Inclusion

Exporia 0.3 - Common.php Remote File Inclusion source: https://www.securityfocus.com/bid/20205/info Exporia is prone to a remote file-include vulnerability because the application fails to sufficiently sanitize user-supplied data. Exploiting this issue could allow an attacker to compromise the...

Opial AV Download Management 1.0 - index.php Cross-Site Scripting

Opial AV Download Management 1.0 - index.php Cross-Site Scripting source: https://www.securityfocus.com/bid/20174/info Opial Audio/Visual Download Management is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data. An attacker may levera...

PHP_news 2.0 - user_user.php?language Remote File Inclusion

PHPnews 2.0 - useruser.php?language Remote File Inclusion source: https://www.securityfocus.com/bid/20209/info PHPNews is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input. A successful exploit of these issues allows an attacker to...

My-BIC 0.6.5 - Mybic_Server.php Remote File Inclusion

My-BIC 0.6.5 - MybicServer.php Remote File Inclusion source: https://www.securityfocus.com/bid/20208/info My-BIC is prone to a remote file-include vulnerability because these applications fail to sufficiently sanitize user-supplied data. Exploiting this issue could allow an attacker to compromise...

Plain Old WebServer 0.0.70.0.8 Firefox Extension - Directory Traversal

Plain Old WebServer 0.0.70.0.8 Firefox Extension - Directory Traversal source: https://www.securityfocus.com/bid/22502/info Plain Old Webserver is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data. Exploiting this issue may allow an...

PHP_news 2.0 - creat_news_all.php?language Remote File Inclusion

PHPnews 2.0 - creatnewsall.php?language Remote File Inclusion source: https://www.securityfocus.com/bid/20209/info PHPNews is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input. A successful exploit of these issues allows an attacker to...