3220 matches found
CVE-2006-5899
The CVE-2006-5899 issue is a PHP remote file inclusion in @cid stats 2.3 via the repertoire parameter of install.php3, enabling remote code execution. The root cause is the presence of install.php3 that can be invoked with a URL parameter to include arbitrary PHP code. The notes in sources indica...
@cid Stats 2.3 - 'Install.php3' Remote File Inclusion
source: https://www.securityfocus.com/bid/20925/info The '@cid stats' program is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue may allow an attacker to compromise the application and the underlying system; other...
Debian DSA-1148-1 : gallery - several vulnerabilities
Several remote vulnerabilities have been discovered in gallery, a web-based photo album. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2005-2734 A cross-site scripting vulnerability allows injection of web script code through HTML or EXIF information. ...
PT-2006-5967 · Isearch · Isearch
Name of the Vulnerable Software and Affected Versions: iSearch version 2.16 Description: The issue concerns remote file inclusion vulnerabilities that could allow remote attackers to execute arbitrary PHP code. This is achieved by providing a URL in the isearch path parameter within various PHP...
osCommerce 2.2 - '/admin/stats_products_purchased.php?page' Cross-Site Scripting
source: https://www.securityfocus.com/bid/20343/info osCommerce is prone to multiple cross-site scripting vulnerabilities. An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attack...
CVE-2006-3580
SQL injection vulnerability in pages.asp in ASP Stats Generator before 2.1.2 allows remote attackers to execute arbitrary SQL commands via the order parameter...
CVE-2006-3580
SQL injection vulnerability in pages.asp in ASP Stats Generator before 2.1.2 allows remote attackers to execute arbitrary SQL commands via the order parameter...
CVE-2006-3580
CVE-2006-3580 describes an SQL injection in pages.asp of the ASP Stats Generator before 2.1.2. Remote attackers can execute arbitrary SQL commands via the order parameter. The CVSS data (base 7.5, HIGH) indicates Potential impact to confidentiality, integrity, and availability (partial for each)....
CVE-2006-3544
Multiple SQL injection vulnerabilities in Invision Power Board IPB 1.3 Final allow remote attackers to execute arbitrary SQL commands via the CODE parameter in a 1 Stats, 2 Mail, and 3 Reg action in index.php. NOTE: the developer has disputed this issue, stating that "At no point does the CODE...
PT-2006-4419 · Invision · Invision Power Board
Name of the Vulnerable Software and Affected Versions: Invision Power Board version 1.3 Final Description: The issue concerns SQL injection vulnerabilities that could allow remote attackers to execute arbitrary SQL commands. This is allegedly possible via the CODE parameter in certain actions in...
CVE-2006-3544
Invision Power Board 1.3 Final is affected by multiple SQL injection vulnerabilities via the CODE parameter in index.php actions (Stats, Mail, Reg). The underlying issue is described as CODE being used in a SWITCH to select a function, with attackers potentially modifying CODE to execute SQL comm...
[NT] ASP Stats Generator Multiple Vulnerabilities (SQL Injection, Code Execution)
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...
ASP Stats Generator <= 2.1.1 SQL Injection Vulnerabilities
Exploit for unknown platform in category web applications ========================================================== ASP Stats Generator = 2.1.1 SQL Injection Vulnerabilities ========================================================== /------------------------------------------------ IHS Public...
ASP Stats Generator 2.1.1 - SQL Injection
ASP Stats Generator 2.1.1 - SQL Injection /------------------------------------------------ IHS Public advisory -------------------------------------------------/ ASP Stats Generator SQL-ASP injection - Code Excution ASP Stats Generator is a powerful website counter, completely written in ASP...
ASP Stats Generator 2.1.1 - SQL Injection
/------------------------------------------------ IHS Public advisory -------------------------------------------------/ ASP Stats Generator SQL-ASP injection - Code Excution ASP Stats Generator is a powerful website counter, completely written in ASP programming language. The application is able...
CVE-2006-2981
SQL injection vulnerability in vssearch.php in Arantius Vice Stats before 1.0.1 allows remote attackers to execute arbitrary SQL commands via unknown vectors, a different issue than CVE-2006-2972...
CVE-2006-2981
Arantius Vice Stats is affected by SQL injection in multiple PHP files. CVE-2006-2981 affects vs_search.php (Vice Stats before 1.0.1), enabling remote SQL commands via unknown vectors; CVE-2006-2972 affects vs_resource.php (versions 0.5b and 1.0) via the ID parameter. Root cause in the PHP code a...
CVE-2006-2981
SQL injection vulnerability in vssearch.php in Arantius Vice Stats before 1.0.1 allows remote attackers to execute arbitrary SQL commands via unknown vectors, a different issue than CVE-2006-2972...
