Show filters
87 Total Results
Displaying 51-60 of 87
Sort by:
Attacker Value
Unknown
CVE-2007-1142
Disclosure Date: March 02, 2007 (last updated October 04, 2023)
Cross-site scripting (XSS) vulnerability in Magic News Plus 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the link_parameters parameter in (1) news.php and (2) n_layouts.php.
0
Attacker Value
Unknown
CVE-2007-1141
Disclosure Date: March 02, 2007 (last updated October 04, 2023)
PHP remote file inclusion vulnerability in preview.php in Magic News Plus 1.0.2 allows remote attackers to execute arbitrary PHP code via a URL in the php_script_path parameter. NOTE: This issue may overlap CVE-2006-0723.
0
Attacker Value
Unknown
CVE-2007-1042
Disclosure Date: February 21, 2007 (last updated October 04, 2023)
Directory traversal vulnerability in news.php in Xpression News (X-News) 1.0.1, when magic_quotes_gpc is disabled, allows remote attackers to include arbitrary files or obtain sensitive information via a .. (dot dot) in the xnews-template parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
0
Attacker Value
Unknown
CVE-2007-1040
Disclosure Date: February 21, 2007 (last updated October 04, 2023)
Directory traversal vulnerability in archives.php in Xpression News (X-News) 1.0.1 allows remote attackers to include arbitrary files or obtain sensitive information via a .. (dot dot) in the xnews-template parameter.
0
Attacker Value
Unknown
CVE-2006-6996
Disclosure Date: February 12, 2007 (last updated October 04, 2023)
Multiple cross-site scripting (XSS) vulnerabilities in warforge.NEWS 1.0 allow remote attackers to inject arbitrary HTML and web script via the (1) title and (2) newspost parameters to (a) newsadd.php, and the (3) name, title, and (4) comment parameters to (b) news.php, a different set of vectors than CVE-2006-1818. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
0
Attacker Value
Unknown
CVE-2007-0865
Disclosure Date: February 09, 2007 (last updated October 04, 2023)
SQL injection vulnerability in comments.php in LushiNews 1.01 and earlier allows remote authenticated users to inject arbitrary SQL commands via the id parameter.
0
Attacker Value
Unknown
CVE-2006-6367
Disclosure Date: December 07, 2006 (last updated October 04, 2023)
Multiple SQL injection vulnerabilities in detail.asp in DUware DUdownload 1.1, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the (1) iFile or (2) action parameter. NOTE: the iType parameter is already covered by CVE-2005-3976.
0
Attacker Value
Unknown
CVE-2006-6354
Disclosure Date: December 07, 2006 (last updated October 04, 2023)
Multiple SQL injection vulnerabilities in detail.asp in DuWare DuNews allow remote attackers to execute arbitrary SQL commands via the (1) iNews, (2) iType, or (3) Action parameter. NOTE: the iType parameter in type.asp is covered by CVE-2005-3976.
0
Attacker Value
Unknown
CVE-2006-5838
Disclosure Date: November 10, 2006 (last updated October 04, 2023)
PHP remote file inclusion vulnerability in lib/class.Database.php in NewP News Publication System 1.0.0, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the path parameter.
0
Attacker Value
Unknown
CVE-2006-4240
Disclosure Date: August 21, 2006 (last updated October 04, 2023)
PHP remote file inclusion vulnerability in index.php in Fusion News 3.7 allows remote attackers to execute arbitrary PHP code via a URL in the fpath parameter.
0
