phpMyAdmin < 2.6.1 pl1 Multiple Script File Inclusions

The installed version of phpMyAdmin suffers from multiple local file include flaws due to its failure to sanitize user input prior to its use in PHP 'include' and 'requireonce' calls. Specifically, a remote attacker can control values for the 'GLOBALScfgThemePath' parameter used in...

phpMyAdmin < 2.6.1 pl2 Libraries and Themes Multiple XSS

The installed version of phpMyAdmin suffers from multiple cross-site scripting vulnerabilities due to its failure to sanitize user input in several PHP scripts used as libraries and themes. A remote attacker may use these issues to cause arbitrary code to be executed in a user's browser, to steal...

phpMyAdmin 2.6 - Multiple Local File Inclusions

phpMyAdmin 2.6 - Multiple Local File Inclusions source: https://www.securityfocus.com/bid/12645/info phpMyAdmin is affected by multiple local file include vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it in a PHP...

phpMyAdmin 2.6 - display_tbl_links.lib.php Multiple Cross-Site Scripting Vulnerabilities

phpMyAdmin 2.6 - displaytbllinks.lib.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/12644/info Multiple remote cross-site scripting vulnerabilities affect phpMyAdmin. These issues are due to a failure of the application to properly sanitize user-suppli...

PunBB 3.0/3.1 - Multiple Remote Input Validation Vulnerabilities

source: https://www.securityfocus.com/bid/12652/info Multiple remote input validation vulnerabilities affect PunBB. These issues are due to a failure of the application to sanitize user-supplied input prior to using it to carry out critical functions. The first issue is an SQL injection issue in...

OOApp Guestbook - Multiple HTML Injection Vulnerabilities

source: https://www.securityfocus.com/bid/12647/info OOApp Guestbook is reportedly affected by multiple HTML injection vulnerabilities. These issues occur because the application fails to properly sanitize user-supplied input. The attacker-supplied HTML and script code would be able to access...

phpMyAdmin 2.6 - 'theme_right.css.php' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/12644/info Multiple remote cross-site scripting vulnerabilities affect phpMyAdmin. These issues are due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamically generated Web content. An attacker may...

PBLang Bulletin Board System 4.6 - 'search.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/12631/info PBLang is reportedly affected by a cross-site scripting vulnerability. This issue exists because the application fails to properly sanitize user-supplied input. As a result of this vulnerability, it is possible for a remote attacker to create a...

BibORB 1.3.2 Login Module - Multiple SQL Injections

BibORB 1.3.2 Login Module - Multiple SQL Injections source: https://www.securityfocus.com/bid/12583/info BibORB is reported prone to multiple vulnerabilities arising from insufficient sanitization of user-supplied input. These issues can be exploited by a remote attacker to carry out cross-site...

paFaq beta4 - 'answer.php?offset' SQL Injection

source: https://www.securityfocus.com/bid/12582/info paFaq is reportedly affected by an SQL injection vulnerability. This issue exists because the application fails to properly sanitize user-supplied input before using it in SQL queries. Successful exploitation could result in a compromise of the...

MercuryBoard Forum 1.01.1 - Cross-Site Scripting

MercuryBoard Forum 1.01.1 - Cross-Site Scripting source: https://www.securityfocus.com/bid/12578/info A remote cross-site scripting vulnerability affects the 'forum.php' script of MercuryBoard. This issue is due to a failure of the application to properly sanitize user-supplied input prior to...

AWStats 5.x6.x - Logfile Remote Command Execution

AWStats 5.x6.x - Logfile Remote Command Execution source: https://www.securityfocus.com/bid/12572/info AWStats is reported prone to a remote arbitrary command-execution vulnerability. This issue occurs because the application fails to properly sanitize user-supplied data. Specifically, the...

DCP-Portal Multiple Scripts SQL Injection

The remote host is running DCP-Portal, a content management system powered by PHP. The version of DCP-Portal installed on the remote host fails to sanitize user-supplied input to many of its parameters before using it, either in database queries or dynamic web page generation. An attacker may be...

MercuryBoard Forum 1.0/1.1 - Cross-Site Scripting

source: https://www.securityfocus.com/bid/12578/info A remote cross-site scripting vulnerability affects the 'forum.php' script of MercuryBoard. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamically generated Web content. A...

PHP-Nuke 6.x7.x - Multiple Cross-Site Scripting Vulnerabilities

PHP-Nuke 6.x7.x - Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/12561/info It is reported that PHP-Nuke is affected by various cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied UR...

Brooky CubeCart 2.0.1/2.0.4 - 'index.php?language' Traversal Arbitrary File Access

source: https://www.securityfocus.com/bid/12549/info Brooky CubeCart is reported prone to multiple vulnerabilities. These issues result from insufficient sanitization of user-supplied data and may allow remote attackers to disclose arbitrary files and carry out cross-site scripting attacks. The...

XOOPS Module module 3.0 - Directory Traversal

XOOPS Module module 3.0 - Directory Traversal source: https://www.securityfocus.com/bid/12406/info Xoops Incontent module is reported prone to a directory traversal vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied input. A malicious user could...

AWStats configdir Remote Command Execution Exploit (c code)

Exploit for cgi platform in category web applications =========================================================== AWStats configdir Remote Command Execution Exploit c code =========================================================== / AwStats exploit by Thunder, email protected This exploit makes...

Siteman 1.1 - User Database Privilege Escalation (2)

Siteman 1.1 - User Database Privilege Escalation 2 source: https://www.securityfocus.com/bid/12304/info Siteman is reported prone to a vulnerability that may allow users to gain elevated privileges. This issue results from insufficient sanitization of user-supplied data. Apparently, an attacker c...

GeoBlog 1.0 - viewcat.php SQL Injection

GeoBlog 1.0 - viewcat.php SQL Injection source: https://www.securityfocus.com/bid/16249/info geoBlog is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation coul...