webif-xss.txt

----------------------------- || WWW.SMASH-THE-STACK.NET || ----------------------------- || ADVISORY: IFNET.IT WEBIF XSS VULNERABILITY || 0x00: ABOUT ME || 0x01: DATELINE || 0x02: INFORMATION || 0x03: EXPLOITATION || 0x04: GOOGLE DORK || 0x05: RISK LEVEL || 0x00: ABOUT ME Author: SkyOut Date:...

Unfixed XSS vulnerability at gwar.org.ru

Security researcher iD - uNkn0wn.eu, has submitted on 26/09/2007 a cross-site-scripting XSS vulnerability affecting gwar.org.ru, which at the time of submission ranked 1453096 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 01/10/2007. It is...

Unfixed XSS vulnerability at www.a-market.jp

Security researcher kusomiso.com, has submitted on 25/09/2007 a cross-site-scripting XSS vulnerability affecting www.a-market.jp, which at the time of submission ranked 127760 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 28/09/2007. It is...

Unfixed XSS vulnerability at www.vardguiden.se

Security researcher TraCK10ya, has submitted on 20/09/2007 a cross-site-scripting XSS vulnerability affecting www.vardguiden.se, which at the time of submission ranked 102260 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 22/09/2007. It is...

Unfixed XSS vulnerability at katalog.morbylanga.se

Security researcher By Encore, has submitted on 16/09/2007 a cross-site-scripting XSS vulnerability affecting katalog.morbylanga.se, which at the time of submission ranked 620823 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 20/09/2007. It is...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in SpeedTech PHP Library STPHPLibrary 0.8.0 allow remote attackers to execute arbitrary PHP code via a URL in the 1 dbconf or 2 ADODBDIR parameter to utils/stphpimageshow.php; or a URL in the STPHPLIBDIR parameter to 3 stphpbutton.php, 4...

Sql injection

Multiple SQL injection vulnerabilities in Ripe Website Manager 0.8.9 and earlier allow remote authenticated users to execute arbitrary SQL commands via one or more of the following vectors: the 1 id parameter to a pages/deletepage.php, b navigation/deletemenu.php, and c navigation/deleteitem.php ...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in depouilg.php3 in Stephane Pineau VOTE 1c allow remote attackers to execute arbitrary PHP code via a URL in the 1 NomVote and 2 FilePalHex parameters...

CVE-2007-4384

Multiple PHP remote file inclusion vulnerabilities in depouilg.php3 in Stephane Pineau VOTE 1c allow remote attackers to execute arbitrary PHP code via a URL in the 1 NomVote and 2 FilePalHex parameters...

CVE-2007-4384

Multiple PHP remote file inclusion vulnerabilities in depouilg.php3 in Stephane Pineau VOTE 1c allow remote attackers to execute arbitrary PHP code via a URL in the 1 NomVote and 2 FilePalHex parameters...

CVE-2007-4235

Multiple PHP remote file inclusion vulnerabilities in VietPHP allow remote attackers to execute arbitrary PHP code via a URL in 1 the dirpath parameter to a functions.php, or 2 the language parameter to b admin/index.php or c index.php...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in AL-Athkar 2.0 allow remote attackers to execute arbitrary PHP code via a URL in the 1 include parameter to a Main.php and b get.php and the 2 exec parameter to c count.php...

CVE-2007-4120

Multiple PHP remote file inclusion vulnerabilities in Jelsoft vBulletin 3.6.5 allow remote attackers to execute arbitrary PHP code via a URL in the 1 classfile parameter to includes/functions.php, the 2 nextitem parameter to includes/functionscron.php, and the 3 specialtemplates parameter to...

Unfixed XSS vulnerability at search.doe.mass.edu

Security researcher Genocide, has submitted on 07/12/2007 a cross-site-scripting XSS vulnerability affecting search.doe.mass.edu, which at the time of submission ranked 53537 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 10/12/2007. It is...

EUVD-2007-2590

Multiple PHP remote file inclusion vulnerabilities in telltarget CMS 1.3.3 allow remote attackers to execute arbitrary PHP code via a URL in the 1 ordnertiefe parameter to siteconf.php; or the 2 ttdocroot parameter to a class.csv.php, b produktenachserie.php, or c refkdrubrik.php in functionen/; ...

CVE-2007-2340

Multiple PHP remote file inclusion vulnerabilities in inc/includeall.inc.php in phporacleview allow remote attackers to execute arbitrary PHP code via a URL in the 1 pagedir or 2 incdir parameters...

CVE-2007-2089

Multiple PHP remote file inclusion vulnerabilities in the Jx Development Article 1.1 and earlier component for Mambo and Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the absolutepath parameter to comarticles.php in 1 components/ or 2 classes/html/...

Unfixed XSS vulnerability at www.carsearch.co.uk

Security researcher INull, has submitted on 03/08/2007 a cross-site-scripting XSS vulnerability affecting www.carsearch.co.uk, which at the time of submission ranked 3140641 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 07/08/2007. It is...

Unfixed XSS vulnerability at mujerestam.com

Security researcher TurkProtest, has submitted on 03/03/2007 a cross-site-scripting XSS vulnerability affecting mujerestam.com, which at the time of submission ranked 3724528 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 05/03/2007. It is...

CVE-2006-7045

PHP remote file inclusion vulnerability in Clan Manager Pro CMPRO 1.1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the 1 rootpath and possibly 2 sitepath parameters to a cmpro.ext/comment.core.inc.php and b cmpro.intern/comment.core.inc.php. NOTE: the provenanc...