Code injection

httpsv.exe in HTTP Server 1.6.2 allows remote attackers to obtain sensitive information script source code via a URI with a trailing %20 encoded space...

CVE-2007-3327

httpsv.exe in HTTP Server 1.6.2 allows remote attackers to obtain sensitive information script source code via a URI with a trailing %20 encoded space...

httpsv multiple security vulnerabilities

It's possible to retrieve script source with URL like http://127.0.0.1/test.htm20. DoS on large number of requests to non-existant pages...

CVE-2007-3327: Undefined Security Weakness

httpsv.exe in HTTP Server 1.6.2 allows remote attackers to obtain sensitive information script source code via a URI with a trailing %20 encoded space...

MyServer HTTP server multiple security vulnerabilities

Crossite scripting with demo pages, script source code access with capital character in path...

Directory traversal

Directory traversal vulnerability in index.php in PHP Advanced Transfer Manager phpATM 1.30 allows remote attackers to read arbitrary files and obtain script source code via a .. dot dot in the directory parameter in a downloadfile action...

CVE-2007-1478

download.php in McGallery 0.5b allows remote attackers to read arbitrary files and obtain script source code via the filename parameter...

Code injection

download.php in McGallery 0.5b allows remote attackers to read arbitrary files and obtain script source code via the filename parameter...

CVE-2007-1478

download.php in McGallery 0.5b allows remote attackers to read arbitrary files and obtain script source code via the filename parameter...

CVE-2007-1412: Undefined Security Weakness

The cpdfopen function in the ClibPDF cpdf extension in PHP 4.4.6 allows context-dependent attackers to obtain sensitive information script source code via a long string in the second argument...

webspell-exec.txt

!/usr/bin/php URL: http://www.acid-root.new.fr/ ----------------------------------------------------------------------- Usage: $argv0 -url -file Options Params: -url For example http://victim.com/webspell/ -file The file you wanna upload c99shell.php... Options: -prefix Table prefix default=webs...

yald10-xss.txt

Yet Another Link Directory v1.0 http://yald.sourceforge.net/ Effected files: yald.php --------------------------- yald.php search box XSS User input isn't sanatized before being generated. In the search box for a PoC put: url:...

SoftArtisans FileUp(TM) viewsrc.asp remote script source disclosure exploit

Inge Henriksen Security Advisory - Full Disclosure Proof of Concept at http://ingehenriksen.blogspot.com/ Advisory Name: SoftArtisans FileUpTM viewsrc.asp remote script source disclosure exploit Tested and Confirmed Vulerable: SoftArtisans SAFileUpTM 5.0.14 Standard Severity: High Type: Script...

SoftArtisans SAFileUp 5.0.14 - 'viewsrc.asp' Script Source Disclosure

SoftArtisans FileUp viewsrc.asp remote script source disclosure exploit Advisory Name: SoftArtisans FileUpTM viewsrc.asp remote script source disclosure exploit Tested and Confirmed Vulerable: SoftArtisans SAFileUpTM 5.0.14 Standard Severity: High Type: Script source disclosure From where: Remote...

Mono XSP for ASP.NET Server Crafted Request Script Source Code Disclosure

The remote host is running Mono XSP, a lightweight web server for hosting ASP.NET applications. The version of Mono XSP installed on the remote Windows host fails to properly validate filename extensions in URLs. A remote attacker may be able to leverage this issue to disclose the source of scrip...

Apache 2.2.2 - CGI Script Source Code Information Disclosure

Apache 2.2.2 - CGI Script Source Code Information Disclosure source: https://www.securityfocus.com/bid/19447/info Apache is prone to an information-disclosure vulnerability because it fails to properly handle exceptional conditions. An attacker can exploit this issue to retrieve script source cod...

Code injection

jetty 6.0.x jetty6 beta16 allows remote attackers to read arbitrary script source code via a capital P in the .jsp extension, and probably other mixed case manipulations...

CVE-2006-2759

jetty 6.0.x jetty6 beta16 allows remote attackers to read arbitrary script source code via a capital P in the .jsp extension, and probably other mixed case manipulations...

CVE-2006-2759

Jetty 6.0.x (jetty6) beta16 has an information-disclosure vulnerability: remote attackers can read the source of JSP files by using a capital P in the .jsp extension (and likely other mixed-case variants). The issue is confirmed across multiple sources (NVD, SUSE, GHSA, OSV, Veracode, PRION, CVE ...

CVE-2006-2759: Undefined Security Weakness

jetty 6.0.x jetty6 beta16 allows remote attackers to read arbitrary script source code via a capital P in the .jsp extension, and probably other mixed case manipulations...