X0r_1

3 exploits Active since Jun 2006
CVE-2006-2797 EXPLOITDB text WORKING POC
phpCommunityCalendar 4.0.3 - SQL Injection via Multiple Parameters
Multiple SQL injection vulnerabilities in phpCommunityCalendar 4.0.3 allow remote attackers to execute arbitrary SQL commands via the (1) CalendarDetailsID parameter in (a) month.php, (b) day.php, and (c) delCalendar.php; (2) ID parameter in (d) event.php; (3) AdminUserID parameter in (e) delAdmin.php; (4) EventLocationID parameter in (f) delAddress.php; and (5) LocationID parameter in (g) delCategory.php.
CVE-2006-2798 EXPLOITDB text WORKING POC
phpCommunityCalendar 4.0.3 - Cross-Site Scripting via LoName and AddressLink Parameters
Multiple cross-site scripting (XSS) vulnerabilities in phpCommunityCalendar 4.0.3 allow remote attackers to inject arbitrary web script or HTML via the (1) LoName parameter in (a) week.php and (b) month.php and (2) AddressLink parameter in (c) event.php.
CVE-2006-3387 EXPLOITDB perl WORKING POC
Fusion News 1.0 - Directory Traversal and Arbitrary File Inclusion via fil_config Parameter
Directory traversal vulnerability in sources/post.php in Fusion News 1.0, when register_globals is enabled, allows remote attackers to include arbitrary files via a .. (dot dot) sequence in the fil_config parameter, which can be used to execute PHP code that has been injected into a log file.