Claroline Multiple Script includePath Parameter Remote File Inclusion

The remote host is running Claroline, an open source, web-based, collaborative learning environment written in PHP. The version of Claroline installed on the remote host fails to sanitize input to the 'includePath' parameter before using it to include PHP code in the...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in post.php in SkyeBox 1.2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 name or 2 message parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information,...

Nucleus CMS PLUGINADMIN.php DIR_LIBS Parameter Remote File Inclusion

The remote host is running Nucleus CMS, an open source content management system. The version of Nucleus CMS installed on the remote host fails to sanitize input to the 'DIRLIBS' parameter before using it in a PHP include function in the 'nucleus/libs/PLUGINADMIN.php' script. Provided PHP's...

Cross site scripting

Cross-site scripting XSS vulnerability in Jemscripts DownloadControl 1.0 allows remote attackers to inject arbitrary HTML or web script via the dcid parameter to dc.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. This issue...

CVE-2006-2538

IE Tab 1.0.9 plugin for Mozilla Firefox 1.5.0.3 allows remote user-assisted attackers to cause a denial of service application crash, possibly due to a null dereference, via certain Javascript, as demonstrated using a url parameter to the content/reloaded.html page in a chrome:// URI. Some...

Squirrelcart cart_content.php cart_isp_root Parameter Remote File Inclusion

The remote host is running Squirrelcart, a shopping cart program written in PHP. The version of Squirrelcart installed on the remote host fails to sanitize user-supplied input to the 'cartisproot' parameter of the 'cartcontent.php' script before using it to include PHP code. Provided PHP's...

CVE-2006-2358

Multiple cross-site scripting XSS vulnerabilities in various scripts in Web-Labs CMS allow remote attackers to inject arbitrary web script or HTML via 1 the search parameter and 2 unspecified fields related to e-mail alerts. NOTE: the provenance of this information is unknown; the details are...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in various scripts in Web-Labs CMS allow remote attackers to inject arbitrary web script or HTML via 1 the search parameter and 2 unspecified fields related to e-mail alerts. NOTE: the provenance of this information is unknown; the details are...

CVE-2006-2358

Multiple cross-site scripting XSS vulnerabilities in various scripts in Web-Labs CMS allow remote attackers to inject arbitrary web script or HTML via 1 the search parameter and 2 unspecified fields related to e-mail alerts. NOTE: the provenance of this information is unknown; the details are...

ACal embed/day.php path Parameter Remote File Inclusion

The remote host is running ACal, an open source, web-based event calendar written in PHP. The version of ACal installed on the remote host fails to sanitize user-supplied input to the 'path' parameter of the 'embed/day.php' script before using it in PHP 'include' functions. Provided PHP's...

Cross site scripting

Cross-site scripting XSS vulnerability in Search.do in ManageEngine OpManager 6.0 allows remote attackers to inject arbitrary web script or HTML via the searchTerm parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information...

Cross site scripting

Cross-site scripting XSS vulnerability in index.php in OnlyScript.info Online Universal Payment System Script allows remote attackers to inject arbitrary web script or HTML via the read parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third part...

CVE-2006-2331

Multiple directory traversal vulnerabilities in PHP-Fusion 6.00.306 allow remote attackers to include and execute arbitrary local files via 1 a .. dot dot in the settingslocale parameter in infusions/lastseenuserspanel/lastseenuserspanel.php, and 2 a .. dot dot in the localeset parameter in...

CVE-2006-2326

Directory traversal vulnerability in index.php in OnlyScript.info Online Universal Payment System Script allows remote attackers to read arbitrary files via directory traversal sequences in the read parameter. NOTE: the provenance of this information is unknown; the details are obtained solely fr...

TYPO3 Security Bulletin

Two problems path traversal and SQL injection have been discovered in the extension damdownloads Component Type: Third Party Extension. The extension is not part of the TYPO3 default installation Affected Components: damdownloads Versions: 1.0.1 and earlier Vulnerability Type: Path traversal and...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Jadu CMS allow remote attackers to inject arbitrary web script or HTML via the 1 forename, 2 surname, 3 regemail, 4 emailconf, 5 company, 6 city, 7 postcode, or 8 telephone parameters to site/scripts/register.php. NOTE: the provenance of this...

CVE-2006-2305

Multiple cross-site scripting XSS vulnerabilities in Jadu CMS allow remote attackers to inject arbitrary web script or HTML via the 1 forename, 2 surname, 3 regemail, 4 emailconf, 5 company, 6 city, 7 postcode, or 8 telephone parameters to site/scripts/register.php. NOTE: the provenance of this...

Stadtaus Gaestebuch-Script index.php include_files Parameter Remote File Inclusion

The remote host is running Stadtaus Gaestebuch-Script, a free guestbook written in PHP. The version of Gaestebuch-Script installed on the remote host fails to sanitize input to the 'includefiles' array parameter before using it in a PHP 'include' function in various scripts. Provided PHP's...

Sql injection

Multiple SQL injection vulnerabilities in IA-Calendar allow remote attackers to execute arbitrary SQL commands via the 1 type parameter in a calendarnew.asp and b default.asp, and 2 ID parameter in c calendardetail.asp. NOTE: the provenance of this information is unknown; the details are obtained...

Sql injection

SQL injection vulnerability in allcalendars.asp in MultiCalendars 3.0 allows remote attackers to execute arbitrary SQL commands via the calsids parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information...