OSVDB: Open Sourced Vulnerability Database

Browse Database - By Creditee Aliaksandr Hartsuyeu

Researcher Name:

Researcher Company:

Researcher Country:

Unknown

Vulnerabilities Types:

SQLInjection:	131
XSS:	47
Other:	10
CodeExecution:	9
ArbitraryFile:	2
InfoDisclosure:	2

Displaying vulnerabilities 61 - 100 of 201 in total

<< Back to Browse

« Previous 1 2 3 4 5 6 7 Next »

OSVDB ID	Disclosure Date	Title
24296 [CLOSE] OSVDB ID : 24296 - Disclosed: 2006-03-30 Description: RedCMS contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'email', 'location', or 'website' fields upon submission to the register.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.	2006-03-30	RedCMS register.php Multiple Field XSS
24297 [CLOSE] OSVDB ID : 24297 - Disclosed: 2006-03-30 Description: RedCMS contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the login.php script not properly sanitizing user-supplied input to the 'username' and 'password' variables. This may allow an attacker to inject or manipulate SQL queries in the back-end database.	2006-03-30	RedCMS login.php Multiple Parameter SQL Injection
24298 [CLOSE] OSVDB ID : 24298 - Disclosed: 2006-03-30 Description: RedCMS contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the profile.php script not properly sanitizing user-supplied input to the 'u' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.	2006-03-30	RedCMS profile.php u Parameter SQL Injection
24299 [CLOSE] OSVDB ID : 24299 - Disclosed: 2006-03-30 Description: RedCMS contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the register.php script not properly sanitizing user-supplied input to unspecirfied variables. This may allow an attacker to inject or manipulate SQL queries in the back-end database.	2006-03-30	RedCMS register.php SQL Injection
24290 [CLOSE] OSVDB ID : 24290 - Disclosed: 2006-03-30 Description: QLnews contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'autorx' and 'newsx' variables upon submission to the news.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.	2006-03-30	QLnews news.php Multiple Parameter XSS
24291 [CLOSE] OSVDB ID : 24291 - Disclosed: 2006-03-30 Description: QLnews contains a flaw that may allow a malicious user to execute arbitrary code. The issue is due to the the administrator having permission to add any content to the config.php script. Once modified to contain arbitrary PHP code, an attacker can call the script directly to execute the code.	2006-03-30	QLnews config.php Arbitrary PHP Code Execution
24273 [CLOSE] OSVDB ID : 24273 - Disclosed: 2006-03-29 Description: VNews contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the admin/admin.php script not properly sanitizing user-supplied input to the 'loginvar' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.	2006-03-29	VNews admin/admin.php loginvar Parameter SQL Injection
24274 [CLOSE] OSVDB ID : 24274 - Disclosed: 2006-03-29 Description: VNews contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the news.php script not properly sanitizing user-supplied input to the 'news' and 'nom' variables. This may allow an attacker to inject or manipulate SQL queries in the back-end database.	2006-03-29	VNews news.php Multiple Parameter SQL Injection
24275 [CLOSE] OSVDB ID : 24275 - Disclosed: 2006-03-29 Description: VNews contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'autorkomentarza' or 'tresckomentarza' variables upon submission to the news.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.	2006-03-29	VNews news.php Multiple Parameter XSS
24276 [CLOSE] OSVDB ID : 24276 - Disclosed: 2006-03-29 Description: [V]Book contains a flaw that may allow a remote attacker to execute arbitrary code. The issue occurs because program administrators are allowed to edit the admin/config.php file. By placing custom PHP code and then calling it, the code will be executed with the privileges of the web server.	2006-03-29	VNews admin/config.php Arbitrary PHP Code Execution
24270 [CLOSE] OSVDB ID : 24270 - Disclosed: 2006-03-29 Description: [V]Book contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the index.php script not properly sanitizing user-supplied input to the 'x' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.	2006-03-29	[V]Book index.php x Parameter SQL Injection
24271 [CLOSE] OSVDB ID : 24271 - Disclosed: 2006-03-29 Description: [V]book contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'autor', 'www', 'temat', or 'tresc' variables upon submission to the index.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.	2006-03-29	[V]Book index.php Multiple Parameter XSS
24272 [CLOSE] OSVDB ID : 24272 - Disclosed: 2006-03-29 Description: [V]Book contains a flaw that may allow a remote attacker to execute arbitrary code. The issue occurs because program administrators are allowed to edit the config.php file. By placing custom PHP code and then calling it, the code will be executed with the privileges of the web server.	2006-03-29	[V]Book config.php Arbitrary PHP Code Execution
24265 [CLOSE] OSVDB ID : 24265 - Disclosed: 2006-03-29 Description: phpNewsManager contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the browse.php script not properly sanitizing user-supplied input to unspecified variables. This may allow an attacker to inject or manipulate SQL queries in the back-end database.	2006-03-29	phpNewsManager browse.php SQL Injection
24266 [CLOSE] OSVDB ID : 24266 - Disclosed: 2006-03-29 Description: phpNewsManager contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the category.php script not properly sanitizing user-supplied input to unspecified variables. This may allow an attacker to inject or manipulate SQL queries in the back-end database.	2006-03-29	phpNewsManager category.php SQL Injection
24267 [CLOSE] OSVDB ID : 24267 - Disclosed: 2006-03-29 Description: phpNewsManager contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the gallery.php script not properly sanitizing user-supplied input to unspecified variables. This may allow an attacker to inject or manipulate SQL queries in the back-end database.	2006-03-29	phpNewsManager gallery.php SQL Injection
24268 [CLOSE] OSVDB ID : 24268 - Disclosed: 2006-03-29 Description: phpNewsManager contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the poll.php script not properly sanitizing user-supplied input to unspecified variables. This may allow an attacker to inject or manipulate SQL queries in the back-end database.	2006-03-29	phpNewsManager poll.php SQL Injection
24240 [CLOSE] OSVDB ID : 24240 - Disclosed: 2006-03-28 Description: Null News contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the lostpass.php script not properly sanitizing user-supplied input to the 'user_email' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.	2006-03-28	Null News lostpass.php user_email Parameter SQL Injection
24241 [CLOSE] OSVDB ID : 24241 - Disclosed: 2006-03-28 Description: Null News contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the sub.php script not properly sanitizing user-supplied input to the 'user_email' or 'user_username' variables. This may allow an attacker to inject or manipulate SQL queries in the back-end database.	2006-03-28	Null News sub.php Multiple Parameter SQL Injection
24242 [CLOSE] OSVDB ID : 24242 - Disclosed: 2006-03-28 Description: Null News contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the unsub.php script not properly sanitizing user-supplied input to the 'user_email' or 'user_username' variables. This may allow an attacker to inject or manipulate SQL queries in the back-end database.	2006-03-28	Null News unsub.php Multiple Parameter SQL Injection
24234 [CLOSE] OSVDB ID : 24234 - Disclosed: 2006-03-28 Description: vCounter contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the vCounter.php script not properly sanitizing user-supplied input to the 'url' variable using '_SERVER['REQUEST_URI']'. This may allow an attacker to inject or manipulate SQL queries in the back-end database.	2006-03-28	vCounter vCounter.php url Parameter SQL Injection
24229 [CLOSE] OSVDB ID : 24229 - Disclosed: 2006-03-28 Description: Newsletter contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the newsletter.php script not properly sanitizing user-supplied input to the 'newsletteremail' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.	2006-03-28	Sourceworkshop newsletter.php newsletteremail Parameter SQL Injection
24211 [CLOSE] OSVDB ID : 24211 - Disclosed: 2006-03-27 Description: VSNS Lemon contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the functions/final_functions.php script not properly sanitizing user-supplied input to the 'id' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.	2006-03-27	VSNS Lemon functions/final_functions.php id Parameter SQL Injection
24212 [CLOSE] OSVDB ID : 24212 - Disclosed: 2006-03-27 Description: VSNS Lemon contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'name' variable upon submission to the Add Comment form. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.	2006-03-27	VSNS Lemon Add Comment name Parameter XSS
24213 [CLOSE] OSVDB ID : 24213 - Disclosed: 2006-03-27 Description: VSNS Lemon contains a flaw that may allow a remote attacker to gain access to protected content. The issue occurs because the system uses cookies for authentication, but only bases it off the cookie value, not via password comparison.	2006-03-27	VSNS Lemon Crafted Cookie Authentication Bypass
23972 [CLOSE] OSVDB ID : 23972 - Disclosed: 2006-03-17 Description: Skull-Splitters Download Counter for Wallpapers contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the count.php script not properly sanitizing user-supplied input to the 'count_fieldname', 'url_fieldname', or 'url' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.	2006-03-17	Download Counter for Wallpapers count.php Multiple Parameter SQL Injection
23941 [CLOSE] OSVDB ID : 23941 - Disclosed: 2006-03-17 Description: Skull-Splitters PHP Guestbook contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'url' variable upon submission to the guestbook.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.	2006-03-17	Skull-Splitters PHP Guestbook guestbook.php url Parameter XSS
23944 [CLOSE] OSVDB ID : 23944 - Disclosed: 2006-03-16 Description: Maian Support contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the admin/index.php script not properly sanitizing user-supplied input to the 'email' or 'pass' variables. This may allow an attacker to inject or manipulate SQL queries in the back-end database.	2006-03-16	Maian Support admin/index.php Multiple Parameter SQL Injection
23945 [CLOSE] OSVDB ID : 23945 - Disclosed: 2006-03-16 Description: Maian Weblog contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the print.php script not properly sanitizing user-supplied input to the 'entry' or 'email' variables. This may allow an attacker to inject or manipulate SQL queries in the back-end database.	2006-03-16	Maian Weblog print.php Multiple Parameter SQL Injection
23946 [CLOSE] OSVDB ID : 23946 - Disclosed: 2006-03-16 Description: Maian Weblog contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the mail.php script not properly sanitizing user-supplied input to the 'entry' or 'email' variables. This may allow an attacker to inject or manipulate SQL queries in the back-end database.	2006-03-16	Maian Weblog mail.php Multiple Parameter SQL Injection
23947 [CLOSE] OSVDB ID : 23947 - Disclosed: 2006-03-16 Description: Maian Events contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the events.php script not properly sanitizing user-supplied input to the 'month' or 'year' variables. This may allow an attacker to inject or manipulate SQL queries in the back-end database.	2006-03-16	Maian Events events.php Multiple Parameter SQL Injection
23879 [CLOSE] OSVDB ID : 23879 - Disclosed: 2006-03-12 Description: DSPoll contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the include/results.php script not properly sanitizing user-supplied input to the 'pollid' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.	2006-03-12	DSPoll include/results.php pollid Parameter SQL Injection
23880 [CLOSE] OSVDB ID : 23880 - Disclosed: 2006-03-12 Description: DSPoll contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the include/topolls.php script not properly sanitizing user-supplied input to the 'pollid' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.	2006-03-12	DSPoll include/topolls.php pollid Parameter SQL Injection
23881 [CLOSE] OSVDB ID : 23881 - Disclosed: 2006-03-12 Description: DSPoll contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the include/pollit.php script not properly sanitizing user-supplied input to the 'pollid' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.	2006-03-12	DSPoll include/pollit.php pollid Parameter SQL Injection
23886 [CLOSE] OSVDB ID : 23886 - Disclosed: 2006-03-12 Description: DSDownload contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the search.php script not properly sanitizing user-supplied input to the 'key' and/or 'category' variables. This may allow an attacker to inject or manipulate SQL queries in the back-end database.	2006-03-12	DSDownload search.php Multiple Parameter SQL Injection
23887 [CLOSE] OSVDB ID : 23887 - Disclosed: 2006-03-12 Description: DSDownload contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the downloads.php script not properly sanitizing user-supplied input to the 'key' and/or 'category' variables. This may allow an attacker to inject or manipulate SQL queries in the back-end database.	2006-03-12	DSDownload downloads.php Multiple Parameter SQL Injection
23883 [CLOSE] OSVDB ID : 23883 - Disclosed: 2006-03-12 Description: DSNewsletter contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the include/sub.php script not properly sanitizing user-supplied input to the 'email' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.	2006-03-12	DSNewsletter include/sub.php email Parameter SQL Injection
23884 [CLOSE] OSVDB ID : 23884 - Disclosed: 2006-03-12 Description: DSNewsletter contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the include/confirm.php script not properly sanitizing user-supplied input to the 'email' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.	2006-03-12	DSNewsletter include/confirm.php email Parameter SQL Injection
23885 [CLOSE] OSVDB ID : 23885 - Disclosed: 2006-03-12 Description: DSNewsletter contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the include/unconfirm.php script not properly sanitizing user-supplied input to the 'email' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.	2006-03-12	DSNewsletter include/unconfirm.php email Parameter SQL Injection
23896 [CLOSE] OSVDB ID : 23896 - Disclosed: 2006-03-12 Description: DSLogin contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the index.php (or admin/index.php) script not properly sanitizing user-supplied input to the 'log_userid' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.	2006-03-12	DSLogin index.php log_userid Parameter SQL Injection

« Previous 1 2 3 4 5 6 7 Next »

The database information may change without any notice. Use of the information constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the copyright holder or distributor (OSVDB or OSF) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.