TinyPHP Forum 3.6 - 'makeAdmin' Remote Admin Maker

TinyPHPForum 3.6 Admin Maker By SirDarckCat from elhacker.net Existing User: document.forms0.action=prompt"Path to forum","http://www.server.com/tpf/"+"updatepf.php"; milw0rm.com 2006-08-02...

TinyPHPForum 3.6 - 'UpdatePF.php' Authentication Bypass

source: https://www.securityfocus.com/bid/19281/info TinyPHPForum is prone to an authentication-bypass vulnerability because it fails to prevent an attacker from accessing admin scripts directly without requiring authentication. A remote attacker can exploit this issue to perform administrative...

TinyPHPForum 3.6 - UpdatePF.php Authentication Bypass

TinyPHPForum 3.6 - UpdatePF.php Authentication Bypass source: https://www.securityfocus.com/bid/19281/info TinyPHPForum is prone to an authentication-bypass vulnerability because it fails to prevent an attacker from accessing admin scripts directly without requiring authentication. A remote...

TinyPHPForum 3.6 - 'error.php' Information Disclosure

source: https://www.securityfocus.com/bid/19278/info TinyPHPForum is prone to an information-disclosure vulnerability. This issue arises when a script allows a remote untrusted source to change a victim user's email address, and have their login credentials returned to an attacker. Information th...

TinyPHPForum 3.6 - error.php Information Disclosure

TinyPHPForum 3.6 - error.php Information Disclosure source: https://www.securityfocus.com/bid/19278/info TinyPHPForum is prone to an information-disclosure vulnerability. This issue arises when a script allows a remote untrusted source to change a victim user's email address, and have their login...

TinyPHPForum 3.6 - Multiple Cross-Site Scripting Vulnerabilities (2)

source: https://www.securityfocus.com/bid/19260/info TinyPHPForum is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user...

TinyPHPForum 3.6 - Multiple Cross-Site Scripting Vulnerabilities (1)

source: https://www.securityfocus.com/bid/17553/info TinyPHPForum is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code executed ...

TinyPHPForum 3.6 - Multiple Cross-Site Scripting Vulnerabilities (1)

TinyPHPForum 3.6 - Multiple Cross-Site Scripting Vulnerabilities 1 source: https://www.securityfocus.com/bid/17553/info TinyPHPForum is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacke...

EV0014.txt

New eVuln Advisory: TinyPHPForum Multiple Vulnerabilities --------------------Summary---------------- Software: TinyPHPForum Sowtware's Web Site: http://www.ralpharama.co.uk/tpf/ Versions: 3.6 and earlier Critical Level: Moderate Type: Multiple Vulnerabilities Class: Remote Status: Unpatched...

[eVuln] TinyPHPForum Multiple Vulnerabilities

New eVuln Advisory: TinyPHPForum Multiple Vulnerabilities --------------------Summary---------------- Software: TinyPHPForum Sowtware's Web Site: http://www.ralpharama.co.uk/tpf/ Versions: 3.6 and earlier Critical Level: Moderate Type: Multiple Vulnerabilities Class: Remote Status: Unpatched...

CVE-2006-0104

Directory traversal vulnerability in TinyPHPForum 3.6 and earlier allows remote attackers to create a new user account, create a new topic, or view the profile of a user account, as demonstrated via a .. dot dot in the uname parameter to profile.php...

CVE-2006-0102

Cross-site scripting XSS vulnerability in TinyPHPForum TPF 3.6 and earlier allows remote attackers to inject arbitrary web script via a javascript: scheme in an "a" bbcode tag, possibly the txt parameter to action.php...

Improper access control

TinyPHPForum 3.6 and earlier stores the 1 users/USERNAME.hash and 2 users/USERNAME.email files under the web root with insufficient access control, which allows remote attackers to list all registered users and possibly obtain other sensitive information...

Cross site scripting

Cross-site scripting XSS vulnerability in TinyPHPForum TPF 3.6 and earlier allows remote attackers to inject arbitrary web script via a javascript: scheme in an "a" bbcode tag, possibly the txt parameter to action.php...

Directory traversal

Directory traversal vulnerability in TinyPHPForum 3.6 and earlier allows remote attackers to create a new user account, create a new topic, or view the profile of a user account, as demonstrated via a .. dot dot in the uname parameter to profile.php...

CVE-2006-0103

TinyPHPForum 3.6 and earlier stores the 1 users/USERNAME.hash and 2 users/USERNAME.email files under the web root with insufficient access control, which allows remote attackers to list all registered users and possibly obtain other sensitive information...

CVE-2006-0104

CVE-2006-0104 describes a directory traversal vulnerability in TinyPHPForum 3.6 and earlier. The issue enables remote attackers to perform actions such as creating a new user account, creating a new topic, or viewing another user’s profile by manipulating the uname parameter in profile.php. The a...

CVE-2006-0102

CVE-2006-0102 affects TinyPHPForum (TPF) 3.6 and earlier. The issue is a Cross-site Scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script through a javascript: scheme in an "[a]" bbcode tag, possibly via the txt parameter to action.php. The NVD description conf...

CVE-2006-0102

Cross-site scripting XSS vulnerability in TinyPHPForum TPF 3.6 and earlier allows remote attackers to inject arbitrary web script via a javascript: scheme in an "a" bbcode tag, possibly the txt parameter to action.php...

CVE-2006-0103

TinyPHPForum 3.6 and earlier stores the 1 users/USERNAME.hash and 2 users/USERNAME.email files under the web root with insufficient access control, which allows remote attackers to list all registered users and possibly obtain other sensitive information...