[CLOSE] OSVDB ID : 28838 - Disclosed: 2006-08-26

Description:

(Description Provided by CVE) : Directory traversal vulnerability in link.php in NX5Linx 1.0 allows remote attackers to read arbitrary files via the logo parameter.

[CLOSE] OSVDB ID : 28839 - Disclosed: 2006-08-26

Description:

(Description Provided by CVE) : SQL injection vulnerability in NX5Linx 1.0 allows remote attackers to execute arbitrary SQL commands via the (1) c and (2) l parameters.

[CLOSE] OSVDB ID : 28840 - Disclosed: 2006-08-26

Description:

(Description Provided by CVE) : CRLF injection vulnerability in links.php in NX5Linx 1.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a CRLF sequence in the url parameter.

[CLOSE] OSVDB ID : 28069 - Disclosed: 2006-08-21

Description:

IndexCity contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the list.php script not properly sanitizing user-supplied input to the 'cate_id' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 28070 - Disclosed: 2006-08-21

Description:

IndexCity contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'url' variable upon submission to the add_url2.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 28068 - Disclosed: 2006-08-21

Description:

Guestbook contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'page' form field parameter upon submission to the gbook.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 28066 - Disclosed: 2006-08-21

Description:

Links Manager contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'admin.php' script not properly sanitizing user-supplied input to the 'nick' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 28067 - Disclosed: 2006-08-21

Description:

Links Manager contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the title, description, or keywords variables upon submission to the add_url.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 27451 - Disclosed: 2006-07-22

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 25276 - Disclosed: 2006-05-04

Description:

Newsadmin contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the readarticle.php script not properly sanitizing user-supplied input to the 'nid' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 25167 - Disclosed: 2006-05-01

Description:

Advanced Poll contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the include/call_poll.php script not properly sanitizing user-supplied input to the 'User-Agent' HTTP header field. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 25168 - Disclosed: 2006-05-01

Description:

(Description Provided by CVE) : include/class_poll.php in Advanced Poll 2.0.4 uses the HTTP_X_FORWARDED_FOR (X-Forwarded-For HTTP header) to identify the IP address of a client, which makes it easier for remote attackers to spoof the source IP and bypass voting restrictions.

[CLOSE] OSVDB ID : 25132 - Disclosed: 2006-04-30

Description:

PHP Newsfeed contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the deltables.php script not properly sanitizing user-supplied input to the 'name' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 25133 - Disclosed: 2006-04-30

Description:

PHP Newsfeed contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the manualsubmit.php script not properly sanitizing user-supplied input to the 'select', 'header', 'url', 'source' or 'time' variables. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 25134 - Disclosed: 2006-04-30

Description:

PHP Newsfeed contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the delete.php script not properly sanitizing user-supplied input to the 'num' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 25135 - Disclosed: 2006-04-30

Description:

PHP Newsfeed contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the searchnews.php script not properly sanitizing user-supplied input to the 'tablename' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 25124 - Disclosed: 2006-04-30

Description:

PHP Pro Publish contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'admin/login.php' script not properly sanitizing user-supplied input to the 'email' or 'password' variables. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 25125 - Disclosed: 2006-04-30

Description:

PHP Pro Publish contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'cat.php' script not properly sanitizing user-supplied input to the 'catid' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 25126 - Disclosed: 2006-04-30

Description:

PHP Pro Publish contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'search.php' script not properly sanitizing user-supplied input to the 'find_str' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 25127 - Disclosed: 2006-04-30

Description:

PHP Pro Publish contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'art.php' script not properly sanitizing user-supplied input to the 'artid' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 25128 - Disclosed: 2006-04-30

Description:

PHP Pro Publish contains a flaw that may allow a malicious user to run arbitrary code. The issue is triggered due to 'set_inc.php' not properly sanitizing settings made by administrative users. That way, arbitrary PHP code may be injected, which will be executed when the file is included, resulting in a loss of integrity.

[CLOSE] OSVDB ID : 25163 - Disclosed: 2006-04-29

Description:

HB-NS contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the index.php script not properly sanitizing user-supplied input to the "topic" and "id" variables. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 25164 - Disclosed: 2006-04-29

Description:

HB-NS contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the "poster_name", "poster_email", "poster_homepage", and "message" variables upon submission to the index.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 25157 - Disclosed: 2006-04-29

Description:

(Description Provided by CVE) : SQL injection vulnerability in news.php in AZNEWS allows remote attackers to execute arbitrary SQL commands via the ID parameter.

[CLOSE] OSVDB ID : 25156 - Disclosed: 2006-04-28

Description:

(Description Provided by CVE) : SQL injection vulnerability in login.php in Ruperts News allows remote attackers to execute arbitrary SQL commands via the username parameter.

[CLOSE] OSVDB ID : 24770 - Disclosed: 2006-04-14

Description:

(Description Provided by CVE) : SQL injection vulnerability in authcheck.php in warforge.NEWS 1.0, with magic_quotes_gpc disabled, allows remote attackers to execute arbitrary SQL commands via the (1) authusername and possibly the (2) authpassword cookie.

[CLOSE] OSVDB ID : 24622 - Disclosed: 2006-04-14

Description:

RateIt contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the rateit.php script not properly sanitizing user-supplied input to the 'rateit_id' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 24445 - Disclosed: 2006-04-06

Description:

MWNewsletter contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the unsubscribe.php script not properly sanitizing user-supplied input to the 'user_name' or 'user_email' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 24446 - Disclosed: 2006-04-06

Description:

MWNewsletter contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'user_name' variable upon submission to the subscribe.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 24965 - Disclosed: 2006-04-06

Description:

(Description Provided by CVE) : Cross-site scripting (XSS) vulnerability in mwguest.php in Manic Web MWGuest 2.1.0 allows remote attackers to inject arbitrary web script or HTML via the homepage parameter.

[CLOSE] OSVDB ID : 24397 - Disclosed: 2006-04-05

Description:

N.T. contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'username' variable upon submission to the index.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in an administrator's browser when the "Login Log" page is viewed, leading to a loss of integrity.

[CLOSE] OSVDB ID : 24398 - Disclosed: 2006-04-05

Description:

N.T. contains a flaw that may allow a malicious user to run arbitrary code. The issue is triggered due to ticker.db.php not properly sanitizing unspecified or unknown values. Arbitrary PHP code may be injected, which will be executed when the file is included. It is possible that the flaw may allow the execution of arbitrary commands resulting in a loss of integrity.

[CLOSE] OSVDB ID : 24454 - Disclosed: 2006-04-05

Description:

MD News contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the admin.php script not properly sanitizing user-supplied input to the 'id' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 24455 - Disclosed: 2006-04-05

Description:

MD News contains a flaw that may allow a malicious user to gain access to unauthorized privileges. The issue is triggered by failing to authenticate requests to the administrative scripts. This flaw may lead to a loss of confidentiality or integrity.

[CLOSE] OSVDB ID : 24385 - Disclosed: 2006-04-04

Description:

wpBlog contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the index.php script not properly sanitizing user-supplied input to the 'postid' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 24381 - Disclosed: 2006-04-04

Description:

CzarNews contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'email' variable upon submission to the news.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 24382 - Disclosed: 2006-04-04

Description:

CzarNews contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the cn_auth.php script not properly sanitizing user-supplied input to the 'usern' or 'passw' variables. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 24383 - Disclosed: 2006-04-04

Description:

CzarNews contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the news.php script not properly sanitizing user-supplied input to the 's' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 24384 - Disclosed: 2006-04-04

Description:

CzarNews contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the dpost.php script not properly sanitizing user-supplied input to the 'a' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 24337 - Disclosed: 2006-04-01

Description:

aWebBB contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'tname' or 'fpost' variables upon submission to the post.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.