CVE-2006-4009

Cross-site scripting XSS vulnerability in war.php in Virtual War Vwar 1.5.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the page parameter...

CVE-2006-4010: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in war.php in Virtual War Vwar 1.5.0 and earlier allows remote attackers to execute arbitrary SQL commands via the page parameter. NOTE: other vectors are covered by CVE-2006-3139...

CVE-2006-4009: Undefined Security Weakness

Cross-site scripting XSS vulnerability in war.php in Virtual War Vwar 1.5.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the page parameter...

CVE-2006-3139

Multiple SQL injection vulnerabilities in war.php in Virtual War VWar 1.5.0 R14 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 s, 2 showgame, 3 sortorder, and 4 sortby parameters...

CVE-2006-3139

CVE-2006-3139 concerns multiple SQL injection flaws in war.php of Virtual War (VWar) 1.5.0 R14 and earlier. The vulnerability arises in the war.php handler, where user-supplied input through the parameters (s, showgame, sortorder, sortby) is used to construct SQL queries, enabling remote attacker...

CVE-2006-3139

Multiple SQL injection vulnerabilities in war.php in Virtual War VWar 1.5.0 R14 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 s, 2 showgame, 3 sortorder, and 4 sortby parameters...

CVE-2006-3139: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in war.php in Virtual War VWar 1.5.0 R14 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 s, 2 showgame, 3 sortorder, and 4 sortby parameters...

CVE-2006-2091

admin.php in Virtual War VWar 1.5 and versions before 1.2 allows remote attackers to obtain sensitive information via an invalid vwarroot parameter, which reveals the path in an error message...

CVE-2006-2091

CVE-2006-2091 affects Virtual War (VWar) — specifically VWar 1.5 and all versions before 1.2. The issue is an information disclosure: an invalid vwar_root parameter causes an error message that reveals the server path. This is a remote-access concern with partial confidentiality impact and no int...

CVE-2006-2091: Undefined Security Weakness

admin.php in Virtual War VWar 1.5 and versions before 1.2 allows remote attackers to obtain sensitive information via an invalid vwarroot parameter, which reveals the path in an error message...

PT-2006-2739 · Vwar · Virtual War

PHP remote file inclusion vulnerability in Virtual War VWar 1.5.0 allows remote attackers to execute arbitrary PHP code via a URL in the vwar root parameter to 1 admin/admin.php, 2 war.php, 3 stats.php, 4 news.php, 5 joinus.php, 6 challenge.php, 7 calendar.php, 8 member.php, 9 popup.php, and othe...

CVE-2006-1747: Undefined Security Weakness

PHP remote file inclusion vulnerability in Virtual War VWar 1.5.0 allows remote attackers to execute arbitrary PHP code via a URL in the vwarroot parameter to 1 admin/admin.php, 2 war.php, 3 stats.php, 4 news.php, 5 joinus.php, 6 challenge.php, 7 calendar.php, 8 member.php, 9 popup.php, and other...

Virtual War File İnclusion

Virtual War File nclusion --------------------------------- Site:http://www.vwar.de/ Demo:http://www.vwar.de/demo/ --------------------------------------- File nclusion // get functions $vwarroot = "./"; require $vwarroot . "includes/functionscommon.php"; require $vwarroot...

CVE-2006-1503

PHP remote file inclusion vulnerability in includes/functionsinstall.php in Virtual War VWar 1.5.0 R11 and earlier allows remote attackers to include and execute arbitrary PHP code via a URL in the vwarroot parameter. NOTE: this is a different vulnerability than CVE-2006-1636...

Remote file inclusion

PHP remote file inclusion vulnerability in includes/functionsinstall.php in Virtual War VWar 1.5.0 R11 and earlier allows remote attackers to include and execute arbitrary PHP code via a URL in the vwarroot parameter. NOTE: this is a different vulnerability than CVE-2006-1636...

CVE-2005-4748

Technical details about CVE-2005-4748 are not publicly provided in the supplied documents; no concrete vulnerabilities, affected versions, or fixes are described. Monitor for updates.

CVE-2006-1503

PHP remote file inclusion vulnerability in includes/functionsinstall.php in Virtual War VWar 1.5.0 R11 and earlier allows remote attackers to include and execute arbitrary PHP code via a URL in the vwarroot parameter. NOTE: this is a different vulnerability than CVE-2006-1636...

CVE-2005-4748

PHP remote file include vulnerability in functionsadmin.php in Virtual War VWar 1.5.0 R10 allows remote attackers to include and execute arbitrary PHP code via unspecified attack vectors. NOTE: this issue has been referred to as XSS, but it is clear from the vendor description that it is a file...

CVE-2006-1503: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in includes/functionsinstall.php in Virtual War VWar 1.5.0 R11 and earlier allows remote attackers to include and execute arbitrary PHP code via a URL in the vwarroot parameter. NOTE: this is a different vulnerability than CVE-2006-1636...

CVE-2005-4748: Undefined Security Weakness

PHP remote file include vulnerability in functionsadmin.php in Virtual War VWar 1.5.0 R10 allows remote attackers to include and execute arbitrary PHP code via unspecified attack vectors. NOTE: this issue has been referred to as XSS, but it is clear from the vendor description that it is a file...