Show filters
13 Total Results
Displaying 1-10 of 13
Sort by:
Attacker Value
Unknown
CVE-2008-5927
Disclosure Date: January 21, 2009 (last updated October 04, 2023)
Multiple SQL injection vulnerabilities in admin/usercheck.php in FlexPHPNews 0.0.6 allow remote attackers to execute arbitrary SQL commands via the (1) checkuser parameter (aka username field) or (2) checkpass parameter (aka password field) to admin/index.php. NOTE: some of these details are obtained from third party information.
0
Attacker Value
Unknown
CVE-2008-1696
Disclosure Date: April 08, 2008 (last updated October 04, 2023)
Directory traversal vulnerability in makepost.php in DaZPHPNews 0.1-1, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the prefixdir parameter.
0
Attacker Value
Unknown
CVE-2007-4232
Disclosure Date: August 08, 2007 (last updated October 04, 2023)
PHP remote file inclusion vulnerability in admin/inc/change_action.php in Andreas Robertz PHPNews 0.93 allows remote attackers to execute arbitrary PHP code via a URL in the format_menue parameter.
0
Attacker Value
Unknown
CVE-2006-7081
Disclosure Date: March 02, 2007 (last updated October 04, 2023)
Multiple PHP remote file inclusion vulnerabilities in PhpNews 1.0 allow remote attackers to execute arbitrary PHP code via the Include parameter to (1) Include/lib.inc.php3 and (2) Include/variables.php3.
0
Attacker Value
Unknown
CVE-2006-6356
Disclosure Date: December 07, 2006 (last updated October 04, 2023)
Multiple cross-site scripting (XSS) vulnerabilities in templates/link_temp.php in PHPNews 1.3.0 allow remote attackers to inject arbitrary web script or HTML via the (1) url, (2) id, (3) subject, (4) username, or (5) time parameter.
0
Attacker Value
Unknown
CVE-2006-6357
Disclosure Date: December 07, 2006 (last updated October 04, 2023)
Cross-site scripting (XSS) vulnerability in templates/cat_temp.php in PHPNews 1.3.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
0
Attacker Value
Unknown
CVE-2006-1560
Disclosure Date: March 31, 2006 (last updated February 22, 2025)
Multiple SQL injection vulnerabilities in SkinTech phpNewsManager 1.48 allow remote attackers to execute arbitrary SQL commands via unspecified parameters, possibly (1) id and (2) topicid, in (a) browse.php, (b) category.php, (c) gallery.php, (d) poll.php, and (e) possibly other unspecified scripts. NOTE: portions of the description details are obtained from third party information.
0
Attacker Value
Unknown
CVE-2005-2383
Disclosure Date: July 26, 2005 (last updated February 22, 2025)
SQL injection vulnerability in auth.php in PHPNews 1.2.5 allows remote attackers to execute arbitrary SQL commands via the user parameter in an HTTP POST request.
0
Attacker Value
Unknown
CVE-2005-2156
Disclosure Date: July 06, 2005 (last updated February 22, 2025)
SQL injection vulnerability in news.php in PHPNews 1.2.5 allows remote attackers to execute arbitrary SQL commands via the prevnext parameter.
0
Attacker Value
Unknown
CVE-2005-1237
Disclosure Date: May 02, 2005 (last updated February 22, 2025)
SQL injection vulnerability in news.php in FlexPHPNews 0.0.3 allows remote attackers to execute arbitrary SQL commands via the newsid parameter.
0
