Xoops 2.0.x - 'viewtopic.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/9497/info It has been reported that Xoops may be prone to a cross-site scripting vulnerability that may allow a remote user to execute HTML or script code in a user's browser. HTML and script code may be parsed via the 'topicid' and 'forum' URI parameters...

Xoops 2.0.x - viewtopic.php Cross-Site Scripting

Xoops 2.0.x - viewtopic.php Cross-Site Scripting source: https://www.securityfocus.com/bid/9497/info It has been reported that Xoops may be prone to a cross-site scripting vulnerability that may allow a remote user to execute HTML or script code in a user's browser. HTML and script code may be...

CVE-2003-1550

XOOPS 2.0, and possibly earlier versions, allows remote attackers to obtain sensitive information via an invalid xoopsOption parameter, which reveals the installation path in an error message...

CVE-2003-1453

Cross-site scripting XSS vulnerability in the MytextSanitizer function in XOOPS 1.3.5 through 1.3.9 and XOOPS 2.0 through 2.0.1 allows remote attackers to inject arbitrary web script or HTML via a javascript: URL in an IMG tag...

[Full-Disclosure] XSS vulnerability in XOOPS 2.0.5.1

==================================================================== Advisory by Eye On Security Research Group - India www.eos-india.net ==================================================================== 1...............................................................Product...

Xoops 2.0.5.1 - 'MyLinks Myheader.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/9269/info Xoops is prone to a cross-site scripting vulnerability in the 'myheader.php' script included in the mylinks module. A remote attacker could exploit this issue by embedding hostile HTML and script code in a malicious link to the vulnerable script...

Xoops 2.0.5.1 - MyLinks Myheader.php Cross-Site Scripting

Xoops 2.0.5.1 - MyLinks Myheader.php Cross-Site Scripting source: https://www.securityfocus.com/bid/9269/info Xoops is prone to a cross-site scripting vulnerability in the 'myheader.php' script included in the mylinks module. A remote attacker could exploit this issue by embedding hostile HTML an...

Xoops 1.3.x2.0.x - Multiple Vulnerabilities

Xoops 1.3.x2.0.x - Multiple Vulnerabilities source: https://www.securityfocus.com/bid/9166/info Multiple vulnerabilities were reported in Xoops. These issues include SQL injection and input validation issues that will allow remote attackers to manipulate banners and local variables. Exploitation...

[SCSA-022] Multiple vulnerabilities in Xoops

====================================================================== Security Corporation Security Advisory SCSA-022 Multiple vulnerabilities in Xoops ====================================================================== PROGRAM: Xoops HOMEPAGE: http://www.xoops.org VULNERABLE VERSIONS:...

Xoops 1.3.x/2.0.x - Multiple Vulnerabilities

source: https://www.securityfocus.com/bid/9166/info Multiple vulnerabilities were reported in Xoops. These issues include SQL injection and input validation issues that will allow remote attackers to manipulate banners and local variables. Exploitation could compromise the software or have other...

BBCode XSS in XOOPS CMS

Informations : °°°°°°°°°°°°° Language : PHP Bugged Versions : 1.3.x and less + 2.0.x and less ? not checked Safe Version : 2.0.3 Website : http://www.xoops.org Problem : BBcode XSS PHP Code/Location : °°°°°°°°°°°°°°°°°°° This hole can be used in modules : - Private Messages - News - NewBB forum...

Xoops 1.01.3.x - BBCode HTML Injection

Xoops 1.01.3.x - BBCode HTML Injection source: https://www.securityfocus.com/bid/8414/info Xoops BBCode has been reported prone to an HTML injection vulnerability. It has been reported that an attacker may inject malicious script into areas of Xoops where BBCode is rendered. This issue is due to ...

Xoops 1.0/1.3.x - BBCode HTML Injection

source: https://www.securityfocus.com/bid/8414/info Xoops BBCode has been reported prone to an HTML injection vulnerability. It has been reported that an attacker may inject malicious script into areas of Xoops where BBCode is rendered. This issue is due to a lack of sufficient sanitization...

CVE-2003-0491

The CVE-2003-0491 entry affects the Tutorials 2.0 module in XOOPS and E-XOOPS. It describes a remote code execution via uploading a PHP file without an image MIME type, then directly accessing the uploaded file. This is the stated vulnerability path and impact; no remediation details are provided...

Directory traversal vulnerability on Xoops/E-xoops CMS module "tutorials"

An attacker can use this flaw to execute arbitrary code of his choice on the remote system, run with the privileges of httpd. The code can be written in any scripting language whose parser is run in the remote system in cooporation with httpd, whether as module or executable. Details: This...

Xoops 1.3.x2.0 MyTextSanitizer - HTML Injection

Xoops 1.3.x2.0 MyTextSanitizer - HTML Injection source: https://www.securityfocus.com/bid/7434/info A HTML injection vulnerability has been discovered in Xoops. The problem occurs due to insufficient filtering of HTML and script code by the MyTextSanitizer script. Successful exploitation of this...

XOOPS MyTextSanitizer CSS 1.3x & 2.x

Author: Doxical & Magistrat http://www.blocus-zone.com Date: 25/04/2003 Object: XOOPS MyTextSanitizer Filtering Bug Allows Remote Users to Conduct Cross-Site Scripting Attacks in many modules: News, newbb, private messages, signatures etc... Impact: Disclosure of authentication information,...

Xoops 1.3.x/2.0 MyTextSanitizer - HTML Injection

source: https://www.securityfocus.com/bid/7434/info A HTML injection vulnerability has been discovered in Xoops. The problem occurs due to insufficient filtering of HTML and script code by the MyTextSanitizer script. Successful exploitation of this vulnerability may allow a malicious Xoops user t...

XOOPS Glossary Module glossaire-aff.php lettre Parameter XSS

There is a cross-site scripting issue in the version of XOOPS installed on the remote host that may allow an attacker to steal your user cookies. The flaw lies in 'glossaire-aff.php'. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Ref : Date: 1 Apr 2003 13:08:28 -0000 From: magistrat To:...

XOOPS 1.0 RC1 Multiple Vulnerabilities

The version of XOOPS installed on the remote host is affected by SQL injection, cross-site scripting, and information disclosure. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Ref : Date: 20 Mar 2003 19:58:55 -0000 From: "Gregory" Le Bras To: [email protected] Subject: SCSA-011 Pat...