Stadtaus Gaestebuch-Script index.php include_files Parameter Remote File Inclusion

The remote host is running Stadtaus Gaestebuch-Script, a free guestbook written in PHP. The version of Gaestebuch-Script installed on the remote host fails to sanitize input to the 'includefiles' array parameter before using it in a PHP 'include' function in various scripts. Provided PHP's...

Sql injection

Multiple SQL injection vulnerabilities in IA-Calendar allow remote attackers to execute arbitrary SQL commands via the 1 type parameter in a calendarnew.asp and b default.asp, and 2 ID parameter in c calendardetail.asp. NOTE: the provenance of this information is unknown; the details are obtained...

Sql injection

SQL injection vulnerability in allcalendars.asp in MultiCalendars 3.0 allows remote attackers to execute arbitrary SQL commands via the calsids parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information...

Cross site scripting

Cross-site scripting XSS vulnerability in calendarnew.asp in IA-Calendar allows remote attackers to inject arbitrary web script or HTML via the TypeName1 parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information...

CVE-2006-2221

A third-party installer generation tool, possibly BitRock InstallBuilder, as used in products including Process-one ejabberd 1.1.11 and earlier, generates an installer that allows local users to cause a denial of service via a symlink attack on the bitrockinstaller.log temporary file. NOTE: it is...

Code injection

A third-party installer generation tool, possibly BitRock InstallBuilder, as used in products including Process-one ejabberd 1.1.11 and earlier, generates an installer that allows local users to cause a denial of service via a symlink attack on the bitrockinstaller.log temporary file. NOTE: it is...

CVE-2006-2221

A third-party installer generation tool, possibly BitRock InstallBuilder, as used in products including Process-one ejabberd 1.1.11 and earlier, generates an installer that allows local users to cause a denial of service via a symlink attack on the bitrockinstaller.log temporary file. NOTE: it is...

Sql injection

SQL injection vulnerability in index.php in Invision Power Board allows remote attackers to execute arbitrary SQL commands via the pid parameter in a reputation action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Limbo CMS sql.php classes_dir Parameter Remote File Inclusion

The remote host is running Limbo CMS, a content-management system written in PHP. The version of Limbo CMS installed on the remote host fails to sanitize user-supplied input to the 'classesdir' parameter of the 'classes/adodbt/sql.php' script before using it in PHP 'includeonce' functions. Provid...

Sql injection

SQL injection vulnerability in detail.asp in DUclassified allows remote attackers to execute arbitrary SQL commands via the iPro parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

TYPO3 Security Bulletin

A weakness in the display of forum messages of chcforum has been discovered that may be used to execute arbitrary SQL Component Type: Third Party Extension. The extension is not part of the TYPO3 default installation Affected Components: chcforum Versions: 1.4.4 and earlier Vulnerability Type: SQ...

Information disclosure

PhpWebGallery before 1.6.0RC1 allows remote attackers to obtain arbitrary pictures via a request to picture.php without specifying the cat parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information...

Directory traversal

Multiple directory traversal vulnerabilities in IZArc Archiver 3.5 beta 3 allow remote attackers to write arbitrary files via a ..\ dot dot backslash in a 1 .rar, 2 .tar, 3 .zip, 4 .jar, or 5 .gz archive. NOTE: the provenance of this information is unknown; the details are obtained solely from...

Cross site scripting

Cross-site scripting vulnerability in addevent.php in myEvent 1.x allows remote attackers to inject arbitrary web script or HTML via the eventdesc parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Sql injection

Multiple SQL injection vulnerabilities in myEvent 1.x allow remote attackers to inject arbitrary SQL commands via the eventid parameter to 1 addevent.php or 2 del.php or 3 eventdesc parameter to addevent.php. NOTE: the provenance of this information is unknown; the details are obtained solely fro...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in warforge.NEWS 1.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly including the 1 firstname and 2 lastname parameter in myaccounts.php. NOTE: portions of these details were obtained from third par...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in register.php in Tritanium Bulletin Board TBB 1.2.3 allow remote attackers to inject arbitrary web script or HTML via the 1 newuserrealname and 2 newusericq parameters, a different vector than CVE-2006-1768. NOTE: the provenance of this...

Sphider configset.php settings_dir Parameter Remote File Inclusion

The remote host is running Sphider, an open source web spider and search engine written in PHP. The version of Sphider installed on the remote host fails to sanitize user-supplied input to the 'settingsdir' parameter of the 'admin/configset.php' script before using it in a PHP 'include' function...

Sql injection

Multiple SQL injection vulnerabilities in form.php in JBook 1.4 allow remote attackers to execute arbitrary SQL commands via the 1 nom or 2 mail parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2006-1698

Cross-site scripting XSS vulnerability in Matt Wright Guestbook 2.3.1 allows remote attackers to execute arbitrary web script or HTML via the 1 url, 2 city, 3 state, or 4 country parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...