2635 matches found
pLog register.php Multiple Parameter XSS
The remote host is running pLog, a blogging system written in PHP. The remote version of this software does not perform a proper validation of user-supplied input and is, therefore, vulnerable to a cross-site scripting attack. To exploit this flaw, an attacker would need to use the script...
WebGUI user profile Unspecified Vulnerability
The remote host is running WebGUI, a content management system from Plain Black Software. According to its banner, the version of this software on the remote is earlier than 6.2.9 and thus affected by an undisclosed remote vulnerability related to the 'user profile' feature. %NASLMINLEVEL 70300 C...
[SA12662] PHP-Fusion "homepage address" Script Insertion Vulnerability
TITLE: PHP-Fusion "homepage address" Script Insertion Vulnerability SECUNIA ADVISORY ID: SA12662 VERIFY ADVISORY: http://secunia.com/advisories/12662/ CRITICAL: Moderately critical IMPACT: Cross Site Scripting WHERE: From remote SOFTWARE: PHP-Fusion 4.x http://secunia.com/product/3803/ DESCRIPTIO...
Powie's PSCRIPT Forum fails to filter user posts
Overview Powie's PSCRIPT Forum fails to properly sanitize user input, which allows an attacker to create a user profile that can execute arbitrary scripts in a victim's web browser when the victim views the profile. Description Powie's PSCRIPT Forum is an online forum application written in PHP...
PScript PForum < 1.26 User Profile XSS
Binary data 1731.prm...
CVE-2004-1716
Cross-site scripting XSS vulnerability in PForum before 1.26 allows remote attackers to inject arbitrary web script or HTML via the 1 IRC Server or 2 AIM ID fields in the user profile...
PScript PForum 1.241.25 - User Profile HTML Injection
PScript PForum 1.241.25 - User Profile HTML Injection source: https://www.securityfocus.com/bid/10954/info PScript PForum is reported prone to a HTML injection vulnerability. The vulnerability presents itself due to a lack of sufficient sanitization performed on data submitted through input field...
PScript PForum 1.24/1.25 - User Profile HTML Injection
source: https://www.securityfocus.com/bid/10954/info PScript PForum is reported prone to a HTML injection vulnerability. The vulnerability presents itself due to a lack of sufficient sanitization performed on data submitted through input fields of the PForum user profile form. This could be...
TikiWiki Project 1.8 - User Profile Multiple Option Remote Code Injections
TikiWiki Project 1.8 - User Profile Multiple Option Remote Code Injections source: https://www.securityfocus.com/bid/10100/info Multiple vulnerabilities have been identified in various modules of the application. These vulnerabilities may allow a remote attacker to carry out various attacks such ...
CVE-2004-1926
Tiki CMS/Groupware TikiWiki 1.8.1 and earlier allows remote attackers to inject arbitrary code via the 1 Theme, 2 Country, 3 Real Name, or 4 Displayed time zone fields in a User Profile, or the 5 Name, 6 Description, 7 URL, or 8 Country fields in a Directory/Add Site operation...
[Full-Disclosure] Blogger XSS Vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------ BLOGGER XSS VULNERABILITY - ------------------------------------------------------ Online URL : http://ferruh.mavituna.com/article/?470 Severity : Moderately Critical for Members Permanent Accou...
Opera Skinned & Opera Directory Traversal (Additional Details & a Simple Exploit)
Opera Skinned & Opera Directory Traversal Additional Details & a Simple Exploit: ================================================================================== ADDITIONAL DETAILS: While installing Opera, if the "USE SEPARATE SETTINGS FOR EACH USER" option is selected, the "opera7/profile"...
sql injection in phpbb
I found a vulnerability en phpbb 2.0.5 and prior, is probably also affect 2.0.6 this bug don't affect to version 2.0.7 phpbb have a list of registereds users, when you click on a memebr of this list, you are requesting data to the database for example:...
Microsoft Windows Server 2003 "Shell Folders" Directory Traversal Vulnerability
Title: Microsoft Windows Server 2003 "Shell Folders" Directory Traversal Vulnerability http://www.geocities.co.jp/SiliconValley/1667/advisory08e.html Date: 8 October 2003 Author: Eiji James Yoshida [email protected] Vulnerable: Windows Server 2003 Internet Explorer 6.0 Overview: Windows...
Microsoft Internet Explorer 6 - %USERPROFILE% File Execution
Microsoft Internet Explorer 6 - %USERPROFILE% File Execution source: https://www.securityfocus.com/bid/7826/info Microsoft Internet Explorer is prone to an issue which could permit an attacker to load a known, existing file in a user's temporary directory or possibly other directories in a user's...
Microsoft Internet Explorer 6 - '%USERPROFILE%' File Execution
source: https://www.securityfocus.com/bid/7826/info Microsoft Internet Explorer is prone to an issue which could permit an attacker to load a known, existing file in a user's temporary directory or possibly other directories in a user's profile. It is possible to exploit this issue via a maliciou...
CSS in PHP WEB CHAT
Product: PHP WEB CHAT Version: 2.0 OffSite: http://www.webscriptworld.com Problem: Cross Site Scripting -------------------------------------------- Actions: 1Register http://victim/chatdir/register.php?register=yes&username=OverG&email=scrptalert20"Test!"/scrpt&email1=scrptalert20"Test!"/scrpt 2...
CVE-2002-1659
userprofile.asp in PortalApp 2.2 allows local users to gain privileges by modifying the userid variable...
CVE-2002-1917
CRLF injection vulnerability in the "User Profile: Send Email" feature in Geeklog 1.35 and 1.3.5sr1 allows remote attackers to obtain e-mail addresses by injecting a CRLF into the Subject field and adding a BCC mail header...
Ikonboard 3.1.1 multiple crossite scriptings
Ikonboard 3.1.1 There are few ways to insert HTML tags into board content. 1. Via Photo URL. In profile user can set URL of photo. It's possible to insert URL like javascript:alertdocument.cookie Javascript will be triggered if someone accesses user's profile. 2. Via X-Forwarded-For: header. User...