joffer

3 exploits Active since Nov 2005
CVE-2005-3853 EXPLOITDB text WRITEUP
sNews < 1.3 - SQL Injection via id or category Parameter
SQL injection vulnerability in snews.php in sNews 1.3 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) id and (2) category parameters to index.php.
CVE-2006-0715 EXPLOITDB text WRITEUP
sNews 1.3 - Stored Cross-Site Scripting via Comment Field
Cross-site scripting (XSS) vulnerability in sNews 1.3 allows remote attackers to inject arbitrary web script or HTML via the comment field.
CVE-2006-3392 EXPLOITDB php WORKING POC
Usermin < 1.220 - Arbitrary File Read via Path Traversal with URL-Encoded Bypass
Webmin before 1.290 and Usermin before 1.220 calls the simplify_path function before decoding HTML, which allows remote attackers to read arbitrary files, as demonstrated using "..%01" sequences, which bypass the removal of "../" sequences before bytes such as "%01" are removed from the filename. NOTE: This is a different issue than CVE-2006-3274.