CVE-2020-10431: Improper Neutralization of Input During Web Page Generation

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/manage-templates.php by adding a question mark ? followed by the payload...

PT-2019-14772 · Dolibarr · Dolibarr

Name of the Vulnerable Software and Affected Versions: Dolibarr version 9.0.5 Description: The issue concerns a stored XSS in the Email Template section, specifically affecting the mails templates.php file. This allows a user, regardless of their privileges, to inject scripts that can attack the...

LimeSurvey ‘/admin/templates.php’脚本任意文件上传漏洞

LimeSurvey（前称PHPSurveyor）是LimeSurvey团队开发的一套开源的在线问卷调查程序，它支持调查程序开发、调查问卷发布以及数据收集等功能。 LimeSurvey中存在任意文件上传漏洞，该漏洞源于程序没有成充分过滤用户提交的输入。攻击者可利用该漏洞上传任意文件到受影响计算机，导致在受影响应用程序上下文中执行任意代码。 0 LimeSurvey 目前厂商还没有提供此漏洞的相关补丁或者升级程序，建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.limesurvey.org/...

4Images 1.7.6 Cross Site Request Forgery

!/usr/bin/perl Title : 4images 1.7.6 9 Csrf inject php code Author : Or4nG.M4n Version : 1.7.6 9 Homepage : http://www.4homepages.de/ Dork : "Powered by 4images" video : http://youtu.be/NYFzC9hH54 Thnks+----------------------------------+ | xSs m4n i-Hmx h311c0d3 |.sp. abo.B4sil | HcJ Cyb3r...

4Images 1.7.6-9 - Cross-Site Request Forgery / PHP Code Injection

!/usr/bin/perl Title : 4images 1.7.6 9 Csrf inject php code Author : Or4nG.M4n Version : 1.7.6 9 Homepage : http://www.4homepages.de/ Dork : "Powered by 4images" video : http://youtu.be/NYFzC9hH54 Thnks+----------------------------------+ | xSs m4n i-Hmx h311c0d3 |.sp. abo.B4sil | HcJ Cyb3r...

Directory traversal

Multiple directory traversal vulnerabilities in WordPress 2.0.11 and earlier allow remote attackers to read arbitrary files via a .. dot dot in 1 the page parameter to certain PHP scripts under wp-admin/ or 2 the import parameter to wp-admin/admin.php, as demonstrated by discovering the full path...

Arbitrary file edit, Local file include, Directory traversal and Full path disclosure in WordPress

Здравствуйте 3APA3A! Сообщаю вам о найденной мною Arbitrary file edit, Local file include, Directory traversal и Full path disclosure уязвимостях в WordPress. Дыры в файле templates.php в параметрах file и page и файлах edit-pages.php, categories.php, edit-comments.php, moderation.php, post.php и...

CVE-2007-2084

CVE-2007-2084 affects MobilePublisherphp version 1.1.2 and is described as a PHP remote file inclusion vulnerability in the admin directory. The issue permits an attacker to supply a URL in the auth_method parameter to any of the admin PHP files (index.php, list.php, postreview.php, reindex.php, ...

Cross site scripting

Cross-site scripting XSS vulnerability in the wpexplainnonce function in the nonce AYS functionality wp-includes/functions.php for WordPress 2.0 before 2.0.9 and 2.1 before 2.1.1 allows remote attackers to inject arbitrary web script or HTML via the file parameter to wp-admin/templates.php, and...

WordPress 1.x2.0.x - Templates.php Cross-Site Scripting

WordPress 1.x2.0.x - Templates.php Cross-Site Scripting source: https://www.securityfocus.com/bid/22534/info WordPress is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary...

WordPress <= 2.0.5 - Cross Site Scripting

Because of this vulnerability in wp-admin/templates.php, the attackers can inject arbitrary web script or HTML via the "file" parameter. Solution Update WordPress...

CVE-2006-6808: Undefined Security Weakness

Cross-site scripting XSS vulnerability in wp-admin/templates.php in WordPress 2.0.5 allows remote attackers to inject arbitrary web script or HTML via the file parameter. NOTE: some sources have reported this as a vulnerability in the getfiledescription function in wp-admin/admin-functions.php...

CVE-2006-2103

SQL injection vulnerability in MyBB MyBulletinBoard 1.1.1 allows remote authenticated administrators to execute arbitrary SQL commands via the 1 query string $querystring variable in a admin/adminlogs.php, which is not properly handled by adminfunctions.php; or 2 setid, 3 expand, 4 title, or 5 si...

MyBB1.1.1.txt

MyBB Local SQL Injections .. This Local Injections Only For Admin 1 code adminfunctions.php , line 730 $db-query"INSERT INTO ".TABLEPREFIX."adminlog uid,dateline,scriptname,action,querystring,ipaddress VALUES...

CVE-2006-2103: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in MyBB MyBulletinBoard 1.1.1 allows remote authenticated administrators to execute arbitrary SQL commands via the 1 query string $querystring variable in a admin/adminlogs.php, which is not properly handled by adminfunctions.php; or 2 setid, 3 expand, 4 title, or 5 si...

CVE-2005-4223: Undefined Security Weakness

Multiple "potential" SQL injection vulnerabilities in Utopia News Pro UNP 1.1.4 might allow remote attackers to execute arbitrary SQL commands via 1 the newsid parameter in editnews.php, 2 the catid and question parameters in faq.php, 3 the poster parameter in postnews.php, 4 the tempid parameter...