CVE-2005-2166

CVE-2005-2166 targets Plague News System (version 0.6 and earlier). The vulnerability is a SQL injection in index.php via the cid parameter, enabling remote attackers to execute arbitrary SQL commands. Connected PT-2005-3098 notes affected versions and confirms no publicly known fix in newer vers...

CVE-2005-2138

CVE-2005-2138 describes a Cross-site Scripting (XSS) vulnerability in the Comdev eCommerce 3.0 and 3.1 product line, specifically in index.php. The flaw allows remote attackers to inject arbitrary web script or HTML by injecting Javascript into the onMouseOver event of an anchor tag in a review m...

Plague News System 0.7 - CID Cross-Site Scripting

Plague News System 0.7 - CID Cross-Site Scripting source: https://www.securityfocus.com/bid/14137/info Plague News System is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input to the 'index.php' script. An...

CVE-2002-1884

index.php in Py-Membres 3.1 allows remote attackers to log in as an administrator by setting the pymembs parameter to "admin"...

CVE-2005-2053

Just another flat file JAF CMS before 3.0 Final allows remote attackers to obtain sensitive information via 1 an asterisk in the id parameter, 2 a blank id parameter, or 3 an asterisk in the disp parameter to index.php, which reveals the path in an error message. NOTE: a followup suggests that th...

MercuryBoard 1.1.4 SQL Injection

RST/GHC Advisory 28 Product : MercuryBoard Version : 1.1.4 FILE : index.php VULN : SQL injection CODE : global.php ---------- 71 : $this-agent = isset$SERVER'HTTPUSERAGENT' ? $SERVER'HTTPUSERAGENT' : null; index.php --------- 154 : $mercury-db-query"REPLACE INTO $mercury-preactive activeid,...

CVE-2005-1975

Multiple cross-site scripting XSS vulnerabilities in Annuaire 1Two 1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the id parameter to index.php, or the 2 siteid, 3 nom, 4 email, or 5 commentaire parameters in commentaires.php...

CVE-2005-1951

Multiple HTTP Response Splitting vulnerabilities in osCommerce 2.2 Milestone 2 and earlier allow remote attackers to spoof web content and poison web caches via hex-encoded CRLF "%0d%0a" sequences in the 1 productsid or 2 pid parameter to index.php or 3 goto parameter to banner.php...

CVE-2005-1951

Multiple HTTP Response Splitting vulnerabilities in osCommerce 2.2 Milestone 2 and earlier allow remote attackers to spoof web content and poison web caches via hex-encoded CRLF "%0d%0a" sequences in the 1 productsid or 2 pid parameter to index.php or 3 goto parameter to banner.php...

CVE-2005-1955

Cross-site scripting XSS vulnerability in index.php in singapore 0.9.11 allows remote attackers to inject arbitrary web script or HTML via the gallery parameter...

CVE-2005-1955

Cross-site scripting XSS vulnerability in index.php in singapore 0.9.11 allows remote attackers to inject arbitrary web script or HTML via the gallery parameter...

CVE-2005-1810

SQL injection vulnerability in template-functions-category.php in WordPress 1.5.1 allows remote attackers to execute arbitrary SQL commands via the $catID variable, as demonstrated using the cat parameter to index.php...

CVE-2005-1817

Invision Power Board (IPB) versions 1.0–1.3 are affected by a vulnerability in index.php that allows remote attackers to edit arbitrary forum posts by sending a modified request. The issue is triggered via direct parameter manipulation in a HTTP request to index.php, enabling an attacker to alter...

CVE-2005-1817

Invision Power Board IPB 1.0 through 1.3 allows remote attackers to edit arbitrary forum posts via a direct request to index.php with modified parameters...

CVE-2005-1810

SQL injection vulnerability in template-functions-category.php in WordPress 1.5.1 allows remote attackers to execute arbitrary SQL commands via the $catID variable, as demonstrated using the cat parameter to index.php...

CVE-2005-1800

Cross-site scripting XSS vulnerability in Jaws Glossary gadget 0.4 to 0.5.1 allows remote attackers to inject arbitrary web script or HTML via the term parameter in a view or ViewTerm action to index.php...

CVE-2005-1715

Cross-site scripting XSS vulnerability in index.php for TOPo 2.2 2.2.178 allows remote attackers to inject arbitrary web script or HTML via the 1 m, 2 s, 3 ID, or 4 t parameters, or the 5 field name, 6 Your Web field, or 7 email field in the comments section...

CVE-2005-1715

CVE-2005-1715 describes a reflected cross-site scripting vulnerability in TOPo 2.2 (version 2.2.178), specifically in index.php. The issue allows remote attackers to inject arbitrary script/HTML via several inputs in the comments section and related fields: (1) m, (2) s, (3) ID, (4) t, and (5) fi...

CVE-2005-1673

Multiple SQL injection vulnerabilities in Help Center Live allow remote attackers to execute arbitrary SQL commands via the 1 id parameter to index.php, 2 tid parameter to view.php, fid parameter to 3 download.php or 4 chatdownload.php, 5 status parameter to icon.php, TICKETtid parameter to 6...

CVE-2004-2072

CVE-2004-2072 describes a cross-site scripting (XSS) vulnerability in Mambo Open Source 4.6 (and possibly earlier) via the Itemid parameter in index.php. The underlying issue is a failure to properly sanitize user input in the web application, enabling an attacker to inject script that may run in...