CVE-2003-1453

The vulnerability is an XSS in XOOPS MytextSanitizer affecting XOOPS 1.3.5–1.3.9 and 2.0–2.0.1, exploitable via a javascript: URL in an IMG tag to inject arbitrary script/HTML. The provided documents do not include concrete exploit details, affected product versions beyond those ranges, or a reme...

CVE-2003-1453: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the MytextSanitizer function in XOOPS 1.3.5 through 1.3.9 and XOOPS 2.0 through 2.0.1 allows remote attackers to inject arbitrary web script or HTML via a javascript: URL in an IMG tag...

CVE-2007-5188

Unspecified vulnerability in the XOOPS uploader class in Xoops 2.0.17.1-RC1 and earlier allows remote attackers to upload arbitrary files via unspecified vectors related to improper upload configuration settings in class/uploader.php and class/mimetypes.inc.php, possibly an incomplete blacklist...

Design/Logic Flaw

Unspecified vulnerability in the XOOPS uploader class in Xoops 2.0.17.1-RC1 and earlier allows remote attackers to upload arbitrary files via unspecified vectors related to improper upload configuration settings in class/uploader.php and class/mimetypes.inc.php, possibly an incomplete blacklist...

CVE-2007-5188

CVE-2007-5188 affects XOOPS (uploader class) in XOOPS 2.0.17.1-RC1 and earlier. The issue is an unspecified remote upload vulnerability tied to improper upload configuration in class/uploader.php and class/mimetypes.inc.php, with a possibly incomplete blacklist that omits the .php4 extension. Con...

CVE-2007-5188

Unspecified vulnerability in the XOOPS uploader class in Xoops 2.0.17.1-RC1 and earlier allows remote attackers to upload arbitrary files via unspecified vectors related to improper upload configuration settings in class/uploader.php and class/mimetypes.inc.php, possibly an incomplete blacklist...

CVE-2007-5188: Undefined Security Weakness

Unspecified vulnerability in the XOOPS uploader class in Xoops 2.0.17.1-RC1 and earlier allows remote attackers to upload arbitrary files via unspecified vectors related to improper upload configuration settings in class/uploader.php and class/mimetypes.inc.php, possibly an incomplete blacklist...

xoops101-rfi.txt

!/usr/bin/perl sub header print q ========================================================================= XOOPS modules xfsection 1.01 =Remote File Inclusion Exploit Exploit Coded by fl0 fl0w floflowsupremacyatyahoodotcom PoC:http://site.com/modules/xfsection/modify.php?dirmodule=evilShell?...

Sql injection

SQL injection vulnerability in print.php in the Articles 1.02 and earlier module for Xoops allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2007-3311

SQL injection vulnerability in print.php in the Articles 1.02 and earlier module for Xoops allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2007-3311

SQL injection vulnerability in print.php in the Articles 1.02 and earlier module for Xoops allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2007-3311

The CVE-2007-3311 entry concerns the XOOPS Articles Module (version 1.02 and earlier). The vulnerability is a SQL Injection in print.php via the id parameter, caused by insufficient input sanitization. This allows a remote attacker to execute arbitrary SQL commands against the backend database. P...

CVE-2007-3311: Undefined Security Weakness

SQL injection vulnerability in print.php in the Articles 1.02 and earlier module for Xoops allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2007-3289

PHP remote file inclusion vulnerability in spaw/spawcontrol.class.php in the WiwiMod 0.4 module for XOOPS allows remote attackers to execute arbitrary PHP code via a URL in the spawroot parameter. NOTE: this issue is probably a duplicate of CVE-2006-4656...

CVE-2007-3289

PHP remote file inclusion vulnerability in spaw/spawcontrol.class.php in the WiwiMod 0.4 module for XOOPS allows remote attackers to execute arbitrary PHP code via a URL in the spawroot parameter. NOTE: this issue is probably a duplicate of CVE-2006-4656...

CVE-2007-3289

CVE-2007-3289 is a PHP remote file inclusion vulnerability affecting the WiwiMod 0.4 module for XOOPS, in which an attacker can execute arbitrary PHP code by supplying a URL in the spaw_root parameter of spaw/spaw_control.class.php. The issue is noted as probably a duplicate of CVE-2006-4656. The...

CVE-2007-3289: Undefined Security Weakness

PHP remote file inclusion vulnerability in spaw/spawcontrol.class.php in the WiwiMod 0.4 module for XOOPS allows remote attackers to execute arbitrary PHP code via a URL in the spawroot parameter. NOTE: this issue is probably a duplicate of CVE-2006-4656...

XOOPS Module wiwimod 0.4 - Remote File Inclusion

XOOPS Module wiwimod 0.4 - Remote File Inclusion XOOPS Module WiwiMod v0.4 spawroot RFI Vulnerability D.Script: http://codigolivre.org.br/frs/download.php/1745/xoops2-modwiwimod0.4xavierjimenez.zip V.Code : include $spawroot.'config/spawcontrol.config.php'; include...

XOOPS Module WiwiMod 0.4 Remote File Inclusion Vulnerability

No description provided by source. XOOPS Module WiwiMod v0.4 spawroot RFI Vulnerability D.Script: http://codigolivre.org.br/frs/download.php/1745/xoops2-modwiwimod0.4xavierjimenez.zip V.Code : include $spawroot.'config/spawcontrol.config.php'; include $spawroot.'class/toolbars.class.php'; include...

XOOPS Module wiwimod 0.4 - Remote File Inclusion

XOOPS Module WiwiMod v0.4 spawroot RFI Vulnerability D.Script: http://codigolivre.org.br/frs/download.php/1745/xoops2-modwiwimod0.4xavierjimenez.zip V.Code : include $spawroot.'config/spawcontrol.config.php'; include $spawroot.'class/toolbars.class.php'; include $spawroot.'class/lang.class.php'; ...