1340 matches found
[Full-disclosure] Session data pollution vulnerabilities in web applications
In web applications I've tested recently I have stumbled upon something that seems to be new class of bugs. Quick googling did not turn up any reference to this kind of vulnerabilities, so I thought I should describe it. The problem boils down to the application reusing the same session variable...
Commercial Interactive Media SCOOP! 2.3 - category.asp Multiple Cross-Site Scripting Vulnerabilities
Commercial Interactive Media SCOOP! 2.3 - category.asp Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/16015/info Commercial Interactive Media SCOOP! is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the...
exploit (html) for Advanced Guestbook 2.2
In GOD We Trust; Kachal667 Under9round Team KuT new exploit with HTML for Advanced Guestbook 2.2 . This bug found by BHST. Coded By Hessam-x Note : For use this exploit first change target to victim example : www.targetsite.com/guestbook/admin.php =====HTML CODE : html titleGuestBook 2.2...
Web applications security vulnerabilities (PHP, ASP, CGI, Perl, etc)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...
Web applications security vulnerabilities (PHP, ASP, CGI, Perl, etc)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...
phpCOIN 1.2.2 - 'phpcoinsessid' SQL Injection / Remote Code Execution
this works with magicquotesgpc off usage: launch from Apache, fill in requested fields, then go! Sun-Tzu:"When these five kinds of spy are all at work, none can discover the secret system. This is called "divine manipulation of the threads." It is the sovereign's most precious faculty."...
eazyCMS "page_id" SQL Injection Vulnerability
eazyCMS "pageid" SQL Injection Vulnerability author:r0t hackers.by.lv Date:18 nov. 2005 software: eazyCMS v2 vendor:http://www.eazycms.com/home.php?pageid=2 Software Description: eazyCMS offers the functionality that would, in a custom-made system, cost thousands or tens of thousands - and it's a...
Pinnacle ShowCenter Skin XSS
The remote host runs the Pinnacle ShowCenter web based interface. The remote version of this software is vulnerable to cross-site scripting attack due to a lack of sanity checks on skin parameter in the SettingsBase.php script. With a specially crafted URL, an attacker can cause arbitrary code...
YaBB 1 GOLD SP 1.3.2 Multiple Vulnerabilities
Yet another Bulletin Board YaBB is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2004 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
guestbook.pl
The SPDX-FileCopyrightText: 1999 Mathieu Perrin Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.10099";...
Elite Forum 1.0 - HTML Injection
Elite Forum 1.0 - HTML Injection source: https://www.securityfocus.com/bid/15257/info Elite Forum is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script...
PHP-Nuke Search Enhanced Module 1.12.0 - HTML Injection
PHP-Nuke Search Enhanced Module 1.12.0 - HTML Injection source: https://www.securityfocus.com/bid/15218/info Search Enhanced module for is prone to an HTML injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in...
DCP - portal XSS & SQL attacks
Web Site: http://www.dcp-portal.org/ DCP Portal = v6 This script is possibly vulnerable to SQL Injection attacks AND Cross Site Scripting XSS attacks The script has been tested with these query variables: XSS : http://target/index.php?page=send&cid=scriptalertdocument.cookie;/script XSS - only PO...
Web applications security vulnerabilities (PHP, ASP, CGI, Perl, etc)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...
Web applications security vulnerabilities (PHP, ASP, CGI, Perl, etc)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...
NEPHP 3.0.4 - browse.php Cross-Site Scripting
NEPHP 3.0.4 - browse.php Cross-Site Scripting source: https://www.securityfocus.com/bid/14626/info nePHP is prone to a cross-site scripting vulnerability. This issue is due to a lack of sanitization of user-supplied input. This vulnerability will allow a malicious user to perform attacks on an...
fuseXSS.txt
This was discovered by myself over the weekend. I cant find out what versions of fusebox this vulnerability is in but seeing as it affects the main fusebox page I can only assume it is the latest v4.1.0 and possibly some older versions. According to the Fusebox site, What is Fusebox? Fusebox is a...
[HSC Security Group] SQL Injection in Product Cart 2.6
Hackers Center Security Group http://www.hackerscenter.com/ Zinho's Security Advisory Desc: SQL Injection in Product Cart 2.6 Risk: Medium to High An SQL injection affects Product Cart 2.6. Database Manipulation is possible. viewPrd.asp?idcategory=' Vendor: http://www.earlyimpact.com/ "Our...
FForm Sender 1.0 - 'Processform.php3?Name' Cross-Site Scripting
source: https://www.securityfocus.com/bid/14324/info A cross-site scripting vulnerability affects Form Sender. This issue is due to a failure of the application to properly sanitize user-supplied URI input that will be output in dynamically generated Web pages. This may facilitate the theft of...