CVE-2007-1607

search.php in w-Agora Web-Agora allows remote attackers to obtain potentially sensitive information via a ' quote value followed by certain SQL sequences in the 1 searchforum or 2 searchuser parameter, which force a SQL error...

Sql injection

search.php in w-Agora Web-Agora allows remote attackers to obtain potentially sensitive information via a ' quote value followed by certain SQL sequences in the 1 searchforum or 2 searchuser parameter, which force a SQL error...

CVE-2007-1606

Multiple cross-site scripting XSS vulnerabilities in w-Agora Web-Agora allow remote attackers to inject arbitrary web script or HTML via 1 the showuser parameter to profile.php, the 2 searchforum or 3 searchuser parameter to search.php, or 4 the userid parameter to changepassword.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in w-Agora Web-Agora allow remote attackers to inject arbitrary web script or HTML via 1 the showuser parameter to profile.php, the 2 searchforum or 3 searchuser parameter to search.php, or 4 the userid parameter to changepassword.php...

CVE-2007-1604

Multiple unrestricted file upload vulnerabilities in w-Agora Web-Agora allow remote attackers to upload and execute arbitrary PHP code 1 via a forum message with an attached file, which is stored under forums/hello/hello/notes/ or 2 by using browseavatar.php to upload a file with a double...

CVE-2007-1604

CVE-2007-1604 affects w-Agora (Web-Agora). The vulnerability consists of multiple unrestricted file upload flaws that enable remote attackers to upload and execute arbitrary PHP code. Specifically, an attacker can (1) attach a file to a forum message stored under forums/hello/hello/notes/ or (2) ...

CVE-2007-1606

CVE-2007-1606 affects w-Agora (Web-Agora). It describes multiple XSS vulnerabilities in profile.php (showuser), search.php (search_forum, search_user), and change_password.php (userid). The NVD entry provides a CVSS v2 base score of 4.3 (Medium) with network access, no auth, and partial integrity...

CVE-2007-1607

search.php in w-Agora Web-Agora allows remote attackers to obtain potentially sensitive information via a ' quote value followed by certain SQL sequences in the 1 searchforum or 2 searchuser parameter, which force a SQL error...

CVE-2007-1604

Multiple unrestricted file upload vulnerabilities in w-Agora Web-Agora allow remote attackers to upload and execute arbitrary PHP code 1 via a forum message with an attached file, which is stored under forums/hello/hello/notes/ or 2 by using browseavatar.php to upload a file with a double...

CVE-2007-1605

CVE-2007-1605 involves w-agora 4.2.1 (Web-Agora). The connected documents describe information-disclosure via multiple vectors that reveal internal paths in error messages, triggered by crafted requests to rss.php, index.php, profile.php, and search.php using specific invalid, empty, or sensitive...

CVE-2007-1606

Multiple cross-site scripting XSS vulnerabilities in w-Agora Web-Agora allow remote attackers to inject arbitrary web script or HTML via 1 the showuser parameter to profile.php, the 2 searchforum or 3 searchuser parameter to search.php, or 4 the userid parameter to changepassword.php...

CVE-2007-1607

The CVE-2007-1607 entry concerns the w-Agora (Web-Agora) web app. The vulnerable component is search.php, where the (1) search_forum and (2) search_user parameters can be injected with a quote followed by certain SQL sequences, triggering a SQL error and potentially exposing sensitive information...

CVE-2007-0606

w-agora 4.2.1 allows remote attackers to obtain sensitive information by via the 1 bn array parameter to index.php, which expects a string, and 2 certain parameters to deleteforum.php, which displays the path name in the resulting error message...

Design/Logic Flaw

w-agora 4.2.1 allows remote attackers to obtain sensitive information by via the 1 bn array parameter to index.php, which expects a string, and 2 certain parameters to deleteforum.php, which displays the path name in the resulting error message...

CVE-2007-0606

CVE-2007-0606 affects w-agora 4.2.1. Vulnerability arises from bn[] parameter handling in index.php and certain parameters to delete_forum.php, allowing disclosure of server path via error messages. Impact: information disclosure; no exploitation details provided in the sources beyond error-path ...

CVE-2007-0606

w-agora 4.2.1 allows remote attackers to obtain sensitive information by via the 1 bn array parameter to index.php, which expects a string, and 2 certain parameters to deleteforum.php, which displays the path name in the resulting error message...

Improper access control

W-Agora Web-Agora 4.2.1, when registerglobals is enabled, stores globals.inc under the web document root with insufficient access control, which allows remote attackers to obtain application path information via a direct request...

CVE-2007-0607

W-Agora Web-Agora 4.2.1, when registerglobals is enabled, stores globals.inc under the web document root with insufficient access control, which allows remote attackers to obtain application path information via a direct request...

CVE-2007-0607

W-Agora Web-Agora 4.2.1, when registerglobals is enabled, stores globals.inc under the web document root with insufficient access control, which allows remote attackers to obtain application path information via a direct request...

CVE-2007-0607

CVE-2007-0607 concerns w-agora 4.2.1 where enabling PHP register_globals allows disclosure of the contents of globals.inc by direct requests to the web document root, leaking server paths. The vulnerability stems from insufficient access control around globals.inc, enabling information disclosure...