CVE-2009-3659: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in file/stats.php in BS Counter 2.5.3 allows remote attackers to execute arbitrary SQL commands via the page parameter...

Bs Counter 2.5.3 SQL Injection

Bs Counter 2.5.3 page Sql İnjectşon Vuln. Bgh7 Turk Bilisim Gucleri Script Downlaod http://scripti.org/indir.php?id=595 Expl0it; http://www.target.com/file/stats.php?page='insert+into+counter+countertitle+values+'HackedByBgh7 tu bi gu' Bingoo ! counter name ediT =...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in PhpForums.net mcGallery 1.1 allow remote attackers to inject arbitrary web script or HTML via the lang parameter to 1 admin.php, 2 index.php, 3 sess.php, 4 stats.php, 5 detail.php, 6 resize.php, and 7 show.php. NOTE: the provenance of this...

CVE-2008-6211: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in PhpForums.net mcGallery 1.1 allow remote attackers to inject arbitrary web script or HTML via the lang parameter to 1 admin.php, 2 index.php, 3 sess.php, 4 stats.php, 5 detail.php, 6 resize.php, and 7 show.php. NOTE: the provenance of this...

mcGallery 1.1 - 'stats.php?lang' Cross-Site Scripting

source: https://www.securityfocus.com/bid/28587/info mcGallery is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in t...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in InterWorx Hosting Control Panel InterWorx-CP Webmaster Level SiteWorx 3.0.2 1 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to index.php; and allow remote authenticated users to inject arbitrary web script or HT...

mcLinksCounter 1.2 Remote File Include by iNs

App Name : mcLinksCounter 1.2 HomePage: http://www.phpforums.net Vuln type : Remote File Include RFI Vuln Discovered by : iNs BUG: on file stats.php ,login.php ,detail.php : include "$langfile"; PoC: http://www.site.com/path/stats.php?langfile=sH3lLz? iNs @ uNkn0wn.eu Gr33tz t0: uNkn0wn.eu - iD -...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in EQdkp 1.3.2c and earlier allow remote attackers to inject arbitrary web script or HTML via the show parameter to 1 listmembers.php and 2 stats.php. NOTE: some of these details are obtained from third party information...

CVE-2007-2716: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in EQdkp 1.3.2c and earlier allow remote attackers to inject arbitrary web script or HTML via the show parameter to 1 listmembers.php and 2 stats.php. NOTE: some of these details are obtained from third party information...

CVE-2006-4863: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Marc Cagninacci mcLinksCounter 1.1 allow remote attackers to execute arbitrary PHP code via a URL in the langfile parameter in 1 login.php, 2 stats.php, 3 detail.php, or 4 erase.php. NOTE: CVE and a third party dispute this vulnerability,...

CVE-2006-4827

Multiple PHP remote file inclusion vulnerabilities in Vmist Downstat 1.8 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the art parameter to 1 admin.php, 2 chart.php, 3 modes.php, or 4 stats.php...

CVE-2006-4827: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Vmist Downstat 1.8 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the art parameter to 1 admin.php, 2 chart.php, 3 modes.php, or 4 stats.php...

CVE-2006-3517

CVE-2006-3517 describes a PHP remote file inclusion in RW::Download, specifically for the file stats.php, where enabling register_globals allows an attacker to execute arbitrary PHP code by supplying a URL in the root_path parameter. Evidence from the NVD entry confirms the affected software comp...

CVE-2006-3517: Undefined Security Weakness

PHP remote file inclusion vulnerability in stats.php in RW::Download, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the rootpath parameter...

RW::Download stats.php Remote File Inc.

Title : RW::Download stats.php Remote File Inc. - Site : http://www.Cyber-Warrior.org - Author : StorMBoY - Mail : [email protected] - exploit : http://target/path/stats.php?rootpath=code - Inc. Code : includeonce $ROOTPATH."functions/globalfunctions.php"; - StorMBoY 08.07.2006...

CVE-2006-3012: Undefined Security Weakness

SQL injection vulnerability in phpBannerExchange before 2.0 Update 6 allows remote attackers to execute arbitrary SQL commands via the 1 login parameter in a client/stats.php and b admin/stats.php, or the 2 pass parameter in client/stats.php...

CVE-2006-2545: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Xtreme Topsites 1.1 allow remote attackers to inject arbitrary web script or HTML via the 1 id parameter in stats.php and 2 unspecified inputs in lostid.php, probably the searchthis parameter. NOTE: one or more of these vectors might be resulta...

CVE-2006-2544: Undefined Security Weakness

Multiple SQL injection vulnerabilities in Xtreme Topsites 1.1, with magicquotesgpc disabled, allow remote attackers to execute arbitrary SQL commands via the 1 searchthis parameter in lostid.php and 2 id parameter in stats.php. NOTE: the provenance of this information is unknown; portions of the...

CVE-2006-2532

The CVE-2006-2532 entry concerns Destiney Rated Images Script 0.5.0. The affected component is stats.php where an invalid s parameter can cause an error message to reveal the installation path. The description notes this was initially claimed to be SQL injection, but CVE analysis attributes the i...

topsitesXSS.txt

Xtremescripts Topsites v1.1 Homepage: http://www.xtremescripts.com/topsites.php Description: Xtreme Topsites is a popular topsite PHP script for websites. Most commonly used across anime websites at the moment. The topsite will count hits/clicks in and hits out and will rank them on total hits so...