Sql injection

Multiple SQL injection vulnerabilities in the ExecuteQueries function in private/system/classes/listfactory.class.php in glFusion 1.1.2 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 order and 2 direction parameters to search.php...

FreeWebshop v5.0- Cross Site Scripting & SQL Injection Vulnerabilities

Exploit for php platform in category web applications ====================================================================== FreeWebshop v5.0- Cross Site Scripting & SQL Injection Vulnerabilities ====================================================================== Vendor site =...

VBulletin 4.0.2 query参数跨站脚本漏洞

vBulletin是一款开放源代码的PHP论坛程序。 当searchtype设置为1的时候，vBulletin没有正确的过滤提交给search.php页面的query参数便返回给了用户，远程攻击者可以通过提交恶意参数请求执行跨站脚本攻击，导致在用户浏览器会话中执行任意HTML和脚本代码。 VBulletin 4.0.2 厂商补丁： VBulletin --------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

PHPWind 6.0 multiple cross-site scripting vulnerability-vulnerability warning-the black bar safety net

PHPWind is a domestic of the more popular PHP-based Web forum application. PHPWind 在 访客 注销 时 没有 正确 的 过滤 提交 给 hack.php and search.php and read.php and post.php and thread.php and profile.php and sort.php and message.php and userpay. php, etc. page of request parameters, a remote attacker can submi...

Cross site scripting

Cross-site scripting XSS vulnerability in search.php in CommonSense CMS 5.0 allows remote attackers to inject arbitrary web script or HTML via the q parameter...

CVE-2010-1072

CVE-2010-1072 describes an XSS vulnerability in Sniggabo CMS 2.21, exploitable via the q parameter in search.php. The root cause is insufficient input sanitization allowing arbitrary web script or HTML to be injected. Affected software/function/file: Sniggabo CMS 2.21, search.php (q parameter). I...

Vbulletin 4.0.2 XSS Vulnerability

================================= Vbulletin 4.0.2 XSS Vulnerability ================================= + Vbulletin 4.0.2 XSS Vulnerability 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' /' / /' 0 0 /, // ,/ / 1 1 // /' / // /' / /' 0 0 / / / / / / 1 1 / / 0 0...

PHPWind 6.0 Cross Site Scripting

I found the PHPWind v6.0 just filter the xss code when the visitors login in, but it doesnt do it when login off. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This flaw makes its all the parameters...

Vbulletin 4.0.2 XSS Vulnerability

Exploit for unknown platform in category web applications ================================= Vbulletin 4.0.2 XSS Vulnerability ================================= + Vbulletin 4.0.2 XSS Vulnerability 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0...

PHP-Fusion-AP-7.00.2-Rus (search.php) disclosure ways

===================================================== PHP-Fusion-AP-7.00.2-Rus search.php disclosure ways ===================================================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' /' / /' 0 0 /, // ,/ / 1 1 // /' / // /' / /' 0 0 / / /...

PHP-Fusion-AP-7.00.2-Rus (search.php) disclosure ways

Exploit for unknown platform in category web applications ===================================================== PHP-Fusion-AP-7.00.2-Rus search.php disclosure ways ===================================================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 ...

CVE-2009-4680

The concrete details show PHPDirectorySource 1.x is affected by a SQL injection in search.php via the st parameter, enabling remote execution of arbitrary SQL commands. CVE-2009-4680 is documented with exact vectors; public references (Exploit-DB, Milw0rm, SecurityFocus, Secunia) corroborate the ...

CVE-2009-4681

CVE-2009-4681 affects phpDirectorySource 1.x; the XSS flaw exists in search.php where a malicious value in the st parameter enables remote injection of arbitrary script/HTML. This CVE entry is supported by multiple references (e.g., exploits and advisories) and is listed in NVD. No explicit remed...

mhproducts kleinanzeigenmarkt (search.php) SQL Injection

Exploit for unknown platform in category web applications ======================================================== mhproducts kleinanzeigenmarkt search.php SQL Injection ========================================================...

Mhproducts Kleinanzeigenmarkt SQL Injection

----------------------------Information------------------------------------------------ +Name : mhproducts kleinanzeigenmarkt search.php SQL Injection +Autor : Easy Laster +Date : 09.03.2010 +Script : mhproducts kleinanzeigenmarkt +Download : ---------------- +Demo :...

vBulletin Version 4.0.2 search.php 跨站漏洞

vBulletin是一款开放源代码的PHP论坛程序 search.php在对用户提交数据处理上存在安全漏洞。 http://www.vbulletin.com/forum/search.php?searchtype=1&contenttype=vBBlogBlogEntry&query=%22%3E%3Ciframe%20src=http://www.gohack.org%3E vBulletin Version 4.0.2 等待官方发补丁...

vBulletin 3.0.0 - Cross-Site Scripting

vBulletin 3.0.0 - Cross-Site Scripting Title: vBulletin 3.0.0 XSS Author: Discovered by ROOTEGY Version: vBulletin Version 3.0.0 =============================================== WWW.sec-war.com =============================================== 3.0.0 - Introduction XSS scripts in the script search.ph...

vBulletin 3.0.0 - Cross-Site Scripting

Title: vBulletin 3.0.0 XSS Author: Discovered by ROOTEGY Version: vBulletin Version 3.0.0 =============================================== WWW.sec-war.com =============================================== 3.0.0 - Introduction XSS scripts in the script search.php. In fact, a hole through a browser...

vBulletin 3.0.0 XSS Vulnerability

Exploit for unknown platform in category web applications ================================= vBulletin 3.0.0 XSS Vulnerability ================================= Title: vBulletin 3.0.0 XSS Author: Discovered by ROOTEGY Version: vBulletin Version 3.0.0 3.0.0 - Introduction XSS scripts in the script...

Unfixed XSS vulnerability at www.wontonweb.com

Security researcher Uber0n, has submitted on 26/01/2010 a cross-site-scripting XSS vulnerability affecting www.wontonweb.com, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 14/06/2010. It is currently...