Manuel Lopez

16 exploits Active since Mar 2004
CVE-2004-1968 EXPLOITDB text WRITEUP
OpenBB <= 1.0.6 - Unauthenticated Arbitrary Message Read via ID Parameter
The readmsg action in myhome.php in Open Bulletin Board (OpenBB) 1.0.6 and earlier allows remote attackers to read arbitrary messages by modifying the id parameter.
CVE-2004-0271 EXPLOITDB text WRITEUP
MaxWebPortal - Cross-Site Scripting via Multiple Parameters
Multiple cross-site scripting vulnerabilities (XSS) in MaxWebPortal allow remote attackers to execute arbitrary web script as other users via (1) the sub_name parameter of dl_showall.asp, (2) the SendTo parameter in Personal Messages, (3) the HTTP_REFERER for down.asp, or (4) the image name of an Avatar in the register form.
CVE-2004-0271 EXPLOITDB text WORKING POC
MaxWebPortal - Cross-Site Scripting via Multiple Parameters
Multiple cross-site scripting vulnerabilities (XSS) in MaxWebPortal allow remote attackers to execute arbitrary web script as other users via (1) the sub_name parameter of dl_showall.asp, (2) the SendTo parameter in Personal Messages, (3) the HTTP_REFERER for down.asp, or (4) the image name of an Avatar in the register form.
CVE-2004-1843 EXPLOITDB text WRITEUP
Member Management System 2.1 - SQL Injection
SQL injection vulnerability in Member Management System 2.1 allows remote attackers to execute arbitrary SQL via the ID parameter to (1) resend.asp or (2) news_view.asp.
CVE-2004-1844 EXPLOITDB text WRITEUP
Member Management System 2.1 - Cross-Site Scripting via Error Parameter or Register Page
Cross-site scripting (XSS) vulnerability in Member Management System 2.1 allows remote attackers to inject arbitrary web script or HTML via (1) the err parameter to error.asp or (2) register.asp.
CVE-2004-1843 EXPLOITDB text WRITEUP
Member Management System 2.1 - SQL Injection
SQL injection vulnerability in Member Management System 2.1 allows remote attackers to execute arbitrary SQL via the ID parameter to (1) resend.asp or (2) news_view.asp.
CVE-2004-1846 EXPLOITDB text WRITEUP
News Manager Lite 2.5 - SQL Injection via ID or Filter Parameter
Multiple SQL injection vulnerabilities in News Manager Lite 2.5 allow remote attackers to execute arbitrary SQL code via the (1) ID parameter to more.asp, (2) ID parameter to category_news.asp, or (3) filter parameter to news_sort.asp.
CVE-2004-1845 EXPLOITDB text WRITEUP
News Manager Lite 2.5 - Cross-Site Scripting via Email Parameter or Search Parameter
Multiple cross-site scripting (XSS) vulnerabilities in News Manager Lite 2.5 allow remote attackers to inject arbitrary web script or HTML via the (1) email parameter to comment_add.asp, (2) search parameter to search.asp, or (3) n parameter to category_news_headline.asp.
CVE-2004-1873 EXPLOITDB text WRITEUP
A-CART Pro and A-CART 2.0 - SQL Injection via catcode Parameter
SQL injection vulnerability in category.asp in A-CART Pro and A-CART 2.0 allows remote attackers to gain privileges via the catcode parameter.
CVE-2004-1846 EXPLOITDB text WRITEUP
News Manager Lite 2.5 - SQL Injection via ID or Filter Parameter
Multiple SQL injection vulnerabilities in News Manager Lite 2.5 allow remote attackers to execute arbitrary SQL code via the (1) ID parameter to more.asp, (2) ID parameter to category_news.asp, or (3) filter parameter to news_sort.asp.
CVE-2004-1847 EXPLOITDB text WRITEUP
News Manager Lite 2.5 - Auth Bypass
News Manager Lite 2.5 allows remote attackers to bypass authentication and gain administrator privileges by setting the ADMIN parameter in the NEWS_LOGIN cookie.
CVE-2004-1846 EXPLOITDB text WRITEUP
News Manager Lite 2.5 - SQL Injection via ID or Filter Parameter
Multiple SQL injection vulnerabilities in News Manager Lite 2.5 allow remote attackers to execute arbitrary SQL code via the (1) ID parameter to more.asp, (2) ID parameter to category_news.asp, or (3) filter parameter to news_sort.asp.
CVE-2004-1845 EXPLOITDB text WRITEUP
News Manager Lite 2.5 - Cross-Site Scripting via Email Parameter or Search Parameter
Multiple cross-site scripting (XSS) vulnerabilities in News Manager Lite 2.5 allow remote attackers to inject arbitrary web script or HTML via the (1) email parameter to comment_add.asp, (2) search parameter to search.asp, or (3) n parameter to category_news_headline.asp.
CVE-2004-1845 EXPLOITDB text WRITEUP
News Manager Lite 2.5 - Cross-Site Scripting via Email Parameter or Search Parameter
Multiple cross-site scripting (XSS) vulnerabilities in News Manager Lite 2.5 allow remote attackers to inject arbitrary web script or HTML via the (1) email parameter to comment_add.asp, (2) search parameter to search.asp, or (3) n parameter to category_news_headline.asp.
EIP-2026-100120 EXPLOITDB perl WORKING POC
ASP Portal - Multiple Vulnerabilities
CVE-2004-1844 EXPLOITDB text WRITEUP
Member Management System 2.1 - Cross-Site Scripting via Error Parameter or Register Page
Cross-site scripting (XSS) vulnerability in Member Management System 2.1 allows remote attackers to inject arbitrary web script or HTML via (1) the err parameter to error.asp or (2) register.asp.