RXGoogle.CGI 1.02.5 - Cross-Site Scripting

RXGoogle.CGI 1.02.5 - Cross-Site Scripting source: https://www.securityfocus.com/bid/9575/info The rxgoogle.cgi search script is prone to a cross-site scripting vulnerability because the software fails to sanitize user input and allows various metacharacters that may facilitate cross-site scripti...

RXGoogle.CGI 1.0/2.5 - Cross-Site Scripting

source: https://www.securityfocus.com/bid/9575/info The rxgoogle.cgi search script is prone to a cross-site scripting vulnerability because the software fails to sanitize user input and allows various metacharacters that may facilitate cross-site scripting attacks. An attacker may leverage this...

phpGroupWare 0.9.x - index.php HTML Injection

phpGroupWare 0.9.x - index.php HTML Injection source: https://www.securityfocus.com/bid/12082/info PhpGroupWare is reported to be susceptible to a HTML injection vulnerability. This issue exists because the application fails to properly sanitize user-supplied input. The attacker-supplied HTML and...

PHPGedView 2.x - 'Descendancy.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/11868/info It is reported that PhpGedView is affected by a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input. This issue could permit a remote attacker to create a malicious...

PHPGedView 2.52.6 - Imageview.php Cross-Site Scripting

PHPGedView 2.52.6 - Imageview.php Cross-Site Scripting source: https://www.securityfocus.com/bid/11890/info It is reported that PhpGedView is affected by a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input. This issu...

PHPGedView 2.5/2.6 - 'Source.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/11888/info It is reported that PhpGedView is affected by a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input. This issue could permit a remote attacker to create a malicious...

PHPGedView 2.5/2.6 - 'Timeline.php' SQL Injection

source: https://www.securityfocus.com/bid/11925/info It is reported that PhpGedView is susceptible to a remote SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input prior to including it in an SQL query. This issue allows remote...

iSoft-Solutions QuikStore Shopping Cart 2.12 - 'template' Directory Traversal

source: https://www.securityfocus.com/bid/9283/info It has been reported that QuikStore Shopping Cart may be prone to a directory traversal vulnerability that may allow an attacker to traverse outside the server root directory by using '../' character sequences. The issue exists due to insufficie...

Invision Power Top Site List 2.0 Alpha 3 - SQL Injection (PoC)

Invision Power Top Site List 2.0 Alpha 3 - SQL Injection PoC Invision Power Top Site List SQL Injection Vendor: Invision Power Services Product: Invision Power Top Site List Version: = 2.0 Alpha 3 Website: http://www.invisionpower.com/ BID: 9229 Description: Invision Power Top Site List is a...

elektropost episerver 3/4 - Multiple Vulnerabilities

source: https://www.securityfocus.com/bid/9223/info Multiple vulnerabilities were reported in EPIServer that include directory traversal, information disclosure, and denial of service. These issue result from insufficient sanitization of user-supplied input. Specific version information was not...

PHPWebFileManager 2.0 - 'index.php' Directory Traversal

source: https://www.securityfocus.com/bid/9053/info It has been reported that phpWebFileManager may be prone to a directory traversal vulnerability that may allow an attacker to gain access to sensitive information. The issue presents itself due to insufficient sanitization of user-supplied input...

phpBB 2.0.x - 'profile.php' SQL Injection

source: https://www.securityfocus.com/bid/8994/info A SQL injection vulnerability has been reported for phpBB systems. phpBB, in some cases, does not sufficiently sanitize user-supplied input, which is used when constructing SQL queries to execute on the underlying database. As a result, it is...

Gallery index.php GALLERY_BASEDIR Parameter Remote File Inclusion

The version of Gallery hosted on the remote web server is affected by a remote file inclusion vulnerability due to the application failing to properly sanitize user-supplied input to the 'GALLERYBASEDIR' parameter of the 'index.php' script. An attacker may use this flaw to inject arbitrary code i...

Divine Content Server 5.0 - Error Page Cross-Site Scripting

source: https://www.securityfocus.com/bid/8763/info It has been reported that Divine Content Server is prone to a cross-site scripting vulnerability due to insufficient sanitization of user-supplied input. The problem exists in the 'pagename' attribute in the error page of the software. This issu...

Atrise Everyfind 5.0.2 - search Cross-Site Scripting

Atrise Everyfind 5.0.2 - search Cross-Site Scripting source: https://www.securityfocus.com/bid/8740/info It has been reported that Atrise Everyfind is prone to a cross-site scripting vulnerability due to insufficient sanitization of user-supplied input. The problem exists in the search module of...

Escapade 0.2.1 Beta Scripting Engine - 'PAGE' Cross-Site Scripting

source: https://www.securityfocus.com/bid/8573/info A cross-site scripting vulnerability has been reported for Escapade. The vulnerability exists due to insufficient sanitization of some user-supplied values. An attacker could exploit this issue to execute arbitrary HTML code in the browser of a...

phpBB 2.0.6 - URL BBCode HTML Injection

source: https://www.securityfocus.com/bid/8570/info phpBB BBCode has been reported prone to an HTML injection vulnerability. It has been reported that an attacker may inject malicious script into areas of phpBB where BBCode is rendered, for example, bulletin board posts or private messages. This...

WebCalendar 0.9.x (Multiple Modules) - SQL Injection

WebCalendar 0.9.x Multiple Modules - SQL Injection source: https://www.securityfocus.com/bid/8540/info It has been reported that WebCalendar may be prone to multiple SQL injection issues in the viewt.php, vieww.php, viewv.php, and login.php modules of the software. The problems arise from a lack ...

TSguestbook 2.1 - 'Message' HTML Injection

source: https://www.securityfocus.com/bid/8520/info It has been reported that TSguestbook may be prone to HTML injection attacks. The problem is said to occur due to insufficient sanitization of user-supplied input within the 'message' field. As a result, an attacker may post a guestbook entry...

DCForum+ 1.2 - Subject HTML Injection

DCForum+ 1.2 - Subject HTML Injection source: https://www.securityfocus.com/bid/8384/info DCForum+ is prone to an HTML injection vulnerability. An attacker may exploit this issue by including hostile HTML and script code in the subject field of posts to the bulletin board. This is because the...