Cross-Site Scripting (XSS)

Phpbb is vulnerable to cross-site scripting XSS attacks. The attacks are possible because includes/startup.php does not sanitize the user-supplied input which allows trailing paths to be injected through "Relative Path Overwrite."...

CVE-2015-1431

Cross-site scripting XSS vulnerability in includes/startup.php in phpBB before 3.0.13 allows remote attackers to inject arbitrary web script or HTML via vectors related to "Relative Path Overwrite."...

CVE-2015-1431: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in includes/startup.php in phpBB before 3.0.13 allows remote attackers to inject arbitrary web script or HTML via vectors related to "Relative Path Overwrite."...

PT-2015-5282

Name of the Vulnerable Software and Affected Versions phpBB versions prior to 3.0.13 Description The issue is related to a cross-site scripting XSS vulnerability. This allows remote attackers to inject arbitrary web script or HTML. The vulnerability is related to "Relative Path Overwrite" in the...

Stylemotion WEB//NEWS 1.4 startup.php Cookie SQL Injection

No description provided by source. source: http://www.securityfocus.com/bid/14776/info WEB//NEWS is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. Successful exploitatio...

PT-2011-4653

Name of the Vulnerable Software and Affected Versions OpenCart version 1.4.9.3 Description The issue allows remote attackers to obtain sensitive information via a direct request to a .php file. This is achieved by revealing the installation path in an error message when accessing certain files,...

CVE-2011-3763: Exposure of Sensitive Information to an Unauthorized Actor

OpenCart 1.4.9.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by system/startup.php and certain other files...

CVE-2008-3595: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in examples/txtSQLAdmin/startup.php in txtSQL 2.2 Final allows remote attackers to execute arbitrary PHP code via a URL in the CFGtxtsqlclass parameter...

txtSQL 2.2 Final - startup.php Remote File Inclusion

txtSQL 2.2 Final - startup.php Remote File Inclusion ??????????????????????????????????????????????????????????????????????????????? ?? C r a C k E r ?? ?? T H E C R A C K O F E T E R N A L M I G H T ?? ?????????????????????????????????????????????????????????????????????????????? ????? From The...

txtsql-rfi.txt

┌┌───────────────────────────────────────────────────────────────────────────┐ ││ C r a C k E r ┌┘ ┌┘ T H E C R A C K O F E T E R N A L M I G H T ││ └───────────────────────────────────────────────────────────────────────────┘┘ ┌──── From The Ashes and Dust Rises An Unimaginable crack.... ────┐...

CVE-2007-2774

Multiple PHP remote file inclusion vulnerabilities in SunLight CMS 5.3 allow remote attackers to execute arbitrary PHP code via a URL in the root parameter to 1 connect.php or 2 modules/startup.php...

CVE-2007-2774: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in SunLight CMS 5.3 allow remote attackers to execute arbitrary PHP code via a URL in the root parameter to 1 connect.php or 2 modules/startup.php...

CVE-2006-7119: Undefined Security Weakness

PHP remote file inclusion vulnerability in kernel/system/startup.php in J. He PHPGiggle 12.08 and earlier, as distributed on comscripts.com, allows remote attackers to execute arbitrary PHP code via a URL in the CFGPHPGIGGLEROOT parameter...

PHPGiggle 12.08 (CFG_PHPGIGGLE_ROOT) File Include Vulnerability

No description provided by source. Title : Php Giggle = 12.08 Remote File Include Vulnerability Author : ajann Vuln; File startup.php /File Code,1 startup.php Error: .. .... include$CFGPHPGIGGLEROOT . $CFGMODULEROOT . "/kernel/system/modregistry.inc.php"; include$CFGPHPGIGGLEROOT . $CFGMODULEROOT...

CVE-2005-2896: Undefined Security Weakness

SQL injection vulnerability in WEB//NEWS 1.4 allows remote attackers to execute arbitrary SQL commands via the 1 wnuserpw parameter to startup.php, 2 cat, 3 id, or 4 stof parameter to news.php, or 5 id parameter to print.php...

[NewAngels Advisory #5] Stylemotion WEB//NEWS 1.4 Vulnerabilities

NewAngels Advisory 5 Stylemotion WEB//NEWS 1.4 ============================================================================= Software: WEB//NEWS 1.4 Type: SQL Injections, Path Disclosure Risk: High Date: Sep. 1 2005 Vendor: Stylemotion Credit: ======= Robin 'onkelfisch' Verton...