CVE-2005-4025

Help Desk Reloaded Free Help Desk does not remove or protect install.php once installation is complete, which allows remote attackers to gain privileges via a direct request to install.php, then navigating to accountsetup.php and creating a new user...

CVE-2005-4011

The CVE-2005-4011 vulnerability affects Codewalkers ltwCalendar (aka PHP Event Calendar) and involves a SQL injection in calendar.php via the id parameter. Affected versions are 4.2, 4.1.3 and earlier. The underlying issue is improper input handling that allows remote attackers to execute arbitra...

CVE-2005-4023

The Gallery 2.0 ZipCart module contains an unspecified vulnerability in versions before 2.0.2 that allows an unauthenticated, remote attacker to read arbitrary files, subject to web server user privileges. Exploitation requires the ZipCart module to be installed and active; the vectors are not di...

CVE-2005-4022

CVE-2005-4022 is a Cross-site Scripting (XSS) vulnerability in Gallery 2.0 identified before 2.0.2. The flaw exists in the "Add Image From Web" feature where an attacker can inject arbitrary web script or HTML via Javascript inside an IMG tag. Impact described in public records is limited to web-...

CVE-2005-4018

SQL injection vulnerability in ls.php in Landshop Real Estate Commerce System 0.6.3 and earlier allows remote attackers to execute arbitrary SQL commands via the 1 start, 2 searchorder, 3 searchtype, 4 searcharea, and 5 keyword parameters...

CVE-2005-4015

CVE-2005-4015 affects PHP Web Statistik 1.4. The issue is that the log database is not rotated and the referer field size is not limited, enabling a remote attacker to exhaust log files by issuing a very high number of HTTP requests (demonstrated via pixel.php). The available references describe ...

CVE-2005-4012

The CVE-2005-4012 entry describes multiple cross-site scripting (XSS) vulnerabilities in PHP Web Statistik 1.4 . An attacker can inject arbitrary script via (1) the lastnumber parameter to stat.php and (2) the HTTP Referer to pixel.php. The NVD entry lists a Medium base score (4.3) with no authen...

CVE-2005-4008

CVE-2005-4008 affects Jax Calendar 1.34. A SQL injection flaw exists in jax_calendar.php, exploitable via the cal_id parameter and possibly Y and m parameters, allowing remote attackers to alter/steal data. The NVD reports a CVSSv2 base score of 7.5 ( HIGH ) with network access, low attack comple...

CVE-2005-4019

CVE-2005-4019 affects Relative Real Estate Systems, specifically versions 1.02 and earlier. It is a SQL injection in index.php exploitable via the mls parameter, allowing remote execution of arbitrary SQL commands. The vulnerability has a CVSS base score of 7.5 (HIGH) with network access, low att...

CVE-2005-4016

The CVE-2005-4016 entry describes an SQL injection vulnerability in Widget Property 1.1.19. The affected component is the property.php endpoint, where five parameters (property_id, zip_code, property_type_id, price, city_id) can be manipulated to execute arbitrary SQL commands. The issue enables ...

CVE-2005-4014

CVE-2005-4014 concerns PHP Web Statistik 1.4 where stat.php can be abused to trigger a denial of service (high CPU usage) by sending a large lastnumber value. This is the vulnerability described in the NVD entry for CVE-2005-4014, with a network-remote impact and no confidentiality/integrity loss...

CVE-2005-4009

Summary of confirmed issues (CVE-2005-4009, CVE-2007-3627, related CVEs): PHP Lite Calendar Express 2.2 and earlier contain multiple SQL injection vulnerabilities. The CVE-2005-4009 entries describe injection via the cid and catid parameters to day.php, week.php, month.php, and year.php. The CVE-...

CVE-2005-4017

The CVE-2005-4017 issue concerns Widget Property 1.1.19. The vulnerability is triggered by an invalid lang value in property.php that allows remote attackers to obtain the full server path, which is exposed in the resulting error message. The affected component is property.php within Widget Prope...

CVE-2005-4017

property.php in Widget Property 1.1.19 allows remote attackers to obtain the full server path via an invalid lang value, which leaks the path in the resulting error message...

CVE-2005-4024

Interspire FastFind 2004 and 2005 are affected by a Cross-site Scripting (XSS) vulnerability exploitable via the query parameter, enabling remote script/HTML injection. CVSS v2.0 base score 4.3 (low-medium) with user interaction not required and partial integrity impact. The CVE entry cites the a...

CVE-2005-4026

CVE-2005-4026 affects Geeklog: search.php in Geeklog 1.4.x before 1.4.0rc1 and 1.3.x before 1.3.11sr3. The issue is an information disclosure where invalid datestart and dateend parameters trigger error messages that leak the web server path. This is a remote-style vulnerability that can reveal s...

CVE-2005-4029

WebEOC (pre-6.0.2) is affected by CVE-2005-4029. The issue allows remote attackers to read valid usernames from the HTML source on the WebEOC login page, which could enable further attacks such as brute-forcing to lock out legitimate users. The connected Red Hat and CVE records confirm the same v...

CVE-2005-4025

CVE-2005-4025 affects Help Desk Reloaded Free Help Desk. The vulnerability arises because install.php is not removed/protected after installation, enabling remote attackers to gain privileges by directly requesting install.php and then accessing accountsetup.php to create a new user. Public sourc...

CVE-2005-4027

CVE-2005-4027 affects SimpleBBS 1.1. The issue is a SQL injection vulnerability reported to allow remote attackers to execute arbitrary SQL commands via unspecified search module parameters. The provided sources list a CVSS2 base score of 7.5 (HIGH) with network attack vector, low complexity, and...

CVE-2005-4022

Cross-site scripting XSS vulnerability in the "Add Image From Web" feature in Gallery 2.0 before 2.0.2 allows remote attackers to inject arbitrary web script or HTML via Javascript in an IMG tag...