ACal embed/day.php path Parameter Remote File Inclusion

The remote host is running ACal, an open source, web-based event calendar written in PHP. The version of ACal installed on the remote host fails to sanitize user-supplied input to the 'path' parameter of the 'embed/day.php' script before using it in PHP 'include' functions. Provided PHP's...

Cross site scripting

Cross-site scripting XSS vulnerability in Search.do in ManageEngine OpManager 6.0 allows remote attackers to inject arbitrary web script or HTML via the searchTerm parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information...

Cross site scripting

Cross-site scripting XSS vulnerability in index.php in OnlyScript.info Online Universal Payment System Script allows remote attackers to inject arbitrary web script or HTML via the read parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third part...

CVE-2006-2331

Multiple directory traversal vulnerabilities in PHP-Fusion 6.00.306 allow remote attackers to include and execute arbitrary local files via 1 a .. dot dot in the settingslocale parameter in infusions/lastseenuserspanel/lastseenuserspanel.php, and 2 a .. dot dot in the localeset parameter in...

CVE-2006-2326

Directory traversal vulnerability in index.php in OnlyScript.info Online Universal Payment System Script allows remote attackers to read arbitrary files via directory traversal sequences in the read parameter. NOTE: the provenance of this information is unknown; the details are obtained solely fr...

TYPO3 Security Bulletin

Two problems path traversal and SQL injection have been discovered in the extension damdownloads Component Type: Third Party Extension. The extension is not part of the TYPO3 default installation Affected Components: damdownloads Versions: 1.0.1 and earlier Vulnerability Type: Path traversal and...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Jadu CMS allow remote attackers to inject arbitrary web script or HTML via the 1 forename, 2 surname, 3 regemail, 4 emailconf, 5 company, 6 city, 7 postcode, or 8 telephone parameters to site/scripts/register.php. NOTE: the provenance of this...

CVE-2006-2305

Multiple cross-site scripting XSS vulnerabilities in Jadu CMS allow remote attackers to inject arbitrary web script or HTML via the 1 forename, 2 surname, 3 regemail, 4 emailconf, 5 company, 6 city, 7 postcode, or 8 telephone parameters to site/scripts/register.php. NOTE: the provenance of this...

Stadtaus Gaestebuch-Script index.php include_files Parameter Remote File Inclusion

The remote host is running Stadtaus Gaestebuch-Script, a free guestbook written in PHP. The version of Gaestebuch-Script installed on the remote host fails to sanitize input to the 'includefiles' array parameter before using it in a PHP 'include' function in various scripts. Provided PHP's...

Sql injection

Multiple SQL injection vulnerabilities in IA-Calendar allow remote attackers to execute arbitrary SQL commands via the 1 type parameter in a calendarnew.asp and b default.asp, and 2 ID parameter in c calendardetail.asp. NOTE: the provenance of this information is unknown; the details are obtained...

Sql injection

SQL injection vulnerability in allcalendars.asp in MultiCalendars 3.0 allows remote attackers to execute arbitrary SQL commands via the calsids parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information...

Cross site scripting

Cross-site scripting XSS vulnerability in calendarnew.asp in IA-Calendar allows remote attackers to inject arbitrary web script or HTML via the TypeName1 parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information...

Code injection

A third-party installer generation tool, possibly BitRock InstallBuilder, as used in products including Process-one ejabberd 1.1.11 and earlier, generates an installer that allows local users to cause a denial of service via a symlink attack on the bitrockinstaller.log temporary file. NOTE: it is...

CVE-2006-2221

A third-party installer generation tool, possibly BitRock InstallBuilder, as used in products including Process-one ejabberd 1.1.11 and earlier, generates an installer that allows local users to cause a denial of service via a symlink attack on the bitrockinstaller.log temporary file. NOTE: it is...

CVE-2006-2221

A third-party installer generation tool, possibly BitRock InstallBuilder, as used in products including Process-one ejabberd 1.1.11 and earlier, generates an installer that allows local users to cause a denial of service via a symlink attack on the bitrockinstaller.log temporary file. NOTE: it is...

Sql injection

SQL injection vulnerability in index.php in Invision Power Board allows remote attackers to execute arbitrary SQL commands via the pid parameter in a reputation action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Limbo CMS sql.php classes_dir Parameter Remote File Inclusion

The remote host is running Limbo CMS, a content-management system written in PHP. The version of Limbo CMS installed on the remote host fails to sanitize user-supplied input to the 'classesdir' parameter of the 'classes/adodbt/sql.php' script before using it in PHP 'includeonce' functions. Provid...

Sql injection

SQL injection vulnerability in detail.asp in DUclassified allows remote attackers to execute arbitrary SQL commands via the iPro parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

TYPO3 Security Bulletin

A weakness in the display of forum messages of chcforum has been discovered that may be used to execute arbitrary SQL Component Type: Third Party Extension. The extension is not part of the TYPO3 default installation Affected Components: chcforum Versions: 1.4.4 and earlier Vulnerability Type: SQ...

Information disclosure

PhpWebGallery before 1.6.0RC1 allows remote attackers to obtain arbitrary pictures via a request to picture.php without specifying the cat parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information...