CVE-2008-7091: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Pligg 9.9 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 id parameter to vote.php, which is not properly handled in libs/link.php; 2 id parameter to trackback.php; 3 an unspecified parameter to submit.php; 4 requestTitle...

CVE-2008-7090: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in Pligg 9.9 and earlier allow remote attackers to 1 determine the existence of arbitrary files via a .. dot dot in the $tburl variable in trackback.php, or 2 include arbitrary files via a .. dot dot in the template parameter to settemplate.php...

sablog 1.6 trackback.php转码函数注入漏洞

Sablog-X是一个采用PHP和MySQL构建的博客系统.作为Sablog的后继产品,Sablog-X在代码质量,运行效率,负载能力,安全等级,功能可操控性和权限严密性等方面都在原有的基础上,更上一层楼.凭借Sablog-X作者7年多的安全技术经验,4年的PHP开发经验,强于创新,追求完美的设计理念,使得Sablog-X已获得业内越来越多专家和用户的认可.但是80sec在其中的代码里发现一个安全漏洞，导致远程用户通过SQL注射获得数据库权限，甚至获得管理员权限。 在sablog的trackback.php中的转码函数 function iconv2utf$chs global...

Pligg CMS 9.9.0 - Cross-Site Scripting Local File Inclusion SQL Injection

Pligg CMS 9.9.0 - Cross-Site Scripting Local File Inclusion SQL Injection GulfTech Security Research July 30, 2008 Vendor : Pligg LLC URL : http://www.pligg.com/ Version : Pligg alertdocument.cookie; The above example link would display the end users cookie to them. Of course this can also be use...

CVE-2007-1989: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in DotClear before 1.2.6 allow remote attackers to inject arbitrary web script or HTML via the 1 postid parameter to ecrire/trackback.php or the 2 toolurl parameter to tools/thememng/index.php. NOTE: some of these details are obtained from third...

dotclear-xss.txt

------=Part236063482423.1176380209314 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline Dotclear 1. Cross Site Scripting Vulnerability 1--two cross site scripting vulnerabilities have been discovered in the dotclear1. allowing ...

WordPress wp-trackback. php vulnerability analysis-vulnerability warning-the black bar safety net

WordPress wp-trackback. php vulnerability analysis Text/Superhei 2007/1/9 1. Stefan Esser, a large cattle 2 0 0 7/0 1/0 5 publish a WordPress Trackback Charset Decoding SQL Injection Vulnerability 1 Code:wp-trackback.php $tburl = $POST'url'; $title = $POST'title'; $excerpt = $POST'excerpt';...

WordPress wp-trackback. php vulnerability analysis-vulnerability warning-the black bar safety net

WordPress wp-trackback. php vulnerability analysis Text/Superhei 2007/1/9 1. Stefan Esser, a large cattle 2 0 0 7/0 1/0 5 publish a WordPress Trackback Charset Decoding SQL Injection Vulnerability 1 Code:wp-trackback.php $tburl = $POST'url'; $title = $POST'title'; $excerpt = $POST'excerpt';...

CVE-2007-0233: Undefined Security Weakness

wp-trackback.php in WordPress 2.0.6 and earlier does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary SQL commands via the tbid parameter. NOTE: it could b...

CVE-2006-6540

SQL injection in Bluetrait’s bt-trackback.php (vulnerable before 1.2.0). When trackback is enabled, remote attackers can execute arbitrary SQL commands via unspecified parameters. No remediation details are provided in the connected sources here.

CVE-2006-6540: Undefined Security Weakness

SQL injection vulnerability in bt-trackback.php in Bluetrait before 1.2.0, when trackback is enabled, allows remote attackers to execute arbitrary SQL commands via unspecified parameters. NOTE: some of these details are obtained from third party information...

CVE-2006-4042

Multiple SQL injection vulnerabilities in trackback.php in myWebland myBloggie 2.1.4 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 title, 2 url, 3 excerpt, or 4 blogname parameters...

CVE-2006-4042

CVE-2006-4042 affects the myWebland myBloggie product family, specifically trackback.php in versions 2.1.4 and earlier. The vulnerability is a SQL injection that allows remote attackers to execute arbitrary SQL commands through the parameters (title, url, excerpt, blog_name). The CVSS v2 base sco...

CVE-2006-4042: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in trackback.php in myWebland myBloggie 2.1.4 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 title, 2 url, 3 excerpt, or 4 blogname parameters...

MyBloggie 2.1.4 - trackback.php Multiple SQL Injections

MyBloggie 2.1.4 - trackback.php Multiple SQL Injections !/usr/bin/php -q -d shortopentag=on = 4.1 allowing subs / if $argctrackbackreply1, "Sorry, Trackback failed.. Reason : No title"; if!empty$REQUEST'url' $url=urldecode$REQUEST'url'; if validateurl$url==false $tback-trackbackreply1, "Sorry,...

MyBloggie 2.1.4 - 'trackback.php' Multiple SQL Injections

!/usr/bin/php -q -d shortopentag=on = 4.1 allowing subs / if $argctrackbackreply1, "Sorry, Trackback failed.. Reason : No title"; if!empty$REQUEST'url' $url=urldecode$REQUEST'url'; if validateurl$url==false $tback-trackbackreply1, "Sorry, Trackback failed.. Reason : URL not valid"; else...

CVE-2005-1687: Undefined Security Weakness

SQL injection vulnerability in wp-trackback.php in Wordpress 1.5 and earlier allows remote attackers to execute arbitrary SQL commands via the tbid parameter...

WordPress <=1.5 - SQL injection vulnerability

Because of this vulnerability in wp-trackback.php, attackers can execute arbitrary SQL commands via the "tbid" parameter. Solution Update this plugin...