CVE-2007-5316

CVE-2007-5316 : SQL injection in browsecats.php of the Softbiz Jobs and Recruitment Script allows remote attackers to execute arbitrary SQL via the cid parameter. The vulnerability is evidenced by multiple sources (NVD/NIST entry and related references) describing an injection path in browsecats....

CVE-2007-5312

TorrentTrader Classic 1.07 is affected by a cross-site scripting (XSS) vulnerability. An attacker can inject arbitrary script/HTML via the (1) color parameter to pjirc/css.php and (2) the cat parameter to browse.php, indicating insufficient input sanitization for these parameters. No remediation ...

CVE-2007-5317

...

CVE-2007-5318

TYPOlight webCMS 2.4.6 is affected by an unspecified vulnerability in preview.php that allows remote attackers to download arbitrary files via the src parameter. This entry reports a file-download capability without details on root cause or affected environments beyond TYPOlight 2.4.6, and does n...

CVE-2007-5309

CVE-2007-5309 concerns a PHP remote file inclusion in the Joomla! component com_wmtgallery (Webmaster-Tips.net Flash Image Gallery) via admin.wmtgallery.php. The root cause is improper handling of the mosConfig_live_site parameter, allowing an attacker to cause the server to include a remote PHP ...

CVE-2007-5317

CVE-2007-5317 is rejected/not used; refer to CVE-2007-5292 instead.

CVE-2007-5305

Multiple PHP remote file inclusion vulnerabilities in ELSEIF CMS Beta 0.6 allow remote attackers to execute arbitrary PHP code via a URL in the 1 contenus parameter to a contenus.php; the 2 tpelseifportalrepertoire parameter to b votes.php, c espaceperso.php, d enregistrement.php, e...

CVE-2007-5295

CVE-2007-5295 affects Wikepage Opus 13 2007.2 and TipiWiki 2, via index.php. The underlying issue is multiple cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary script or HTML through the PageContent and PageName parameters. Reported impact per NVD is a Par...

CVE-2007-5303

CVE-2007-5303 is an XSS vulnerability affecting SnewsCMS Rus 2.1, specifically in news_page.php where the page_id parameter can be leveraged to inject arbitrary web scripts or HTML. The NVD entry documents a failed/open-based impact: confidentiality=NONE, integrity=PARTIAL, availability=NONE, wit...

CVE-2007-5300

The CVE-2007-5300 issue affects wzdftpd (notably 0.8.0 and 0.8.2) and is caused by an off-by-one error in wzd_login.c that enables a stack-based buffer overflow when handling a long USER command, leading to a remote denial of service (daemon crash). Public advisory data confirm the vulnerability ...

CVE-2007-5297

Cross-site scripting XSS vulnerability in index.php in Minki 1.30 allows remote attackers to inject arbitrary web script or HTML via the page parameter...

CVE-2007-5306

ELSEIF CMS Beta 0.6 is affected. The vulnerability allows remote attackers to obtain sensitive information (the full file path) via unspecified vectors to users/votesresultats.php. The available sources state the affected software and the exposure but do not specify the root cause details, affect...

CVE-2007-5302

HP System Management Homepage (SMH) is affected by CVE-2007-5302 due to cross-site scripting (XSS) vulnerabilities in SMH components. In HP-UX, affected O/S versions are B.11.11, B.11.23, and B.11.31; SMH versions prior to 2.1.10 are also affected on Linux and Windows. The impact is remote script...

CVE-2007-5292

CVE-2007-5292 is a cross-site scripting (XSS) vulnerability in Directory Image Gallery 1.1, affecting the photos.cfm component via the backwardDirectory parameter. The issue allows remote injection of arbitrary web script/HTML. Documented in NVD/NVD-derived records, with no remediation details or...

CVE-2007-5299

Vulnerability (CVE-2007-5299) : Multiple directory traversal flaws affect SkaDate 5.0 and 6.0 (and possibly later 6.x versions such as 6.482). An attacker can read arbitrary files by supplying .. in the view_mode parameter to (1) featured_list.php and (2) online_list.php under the member/ path. T...

CVE-2007-5297

CVE-2007-5297 affects Minki 1.30, with a vulnerability in index.php where the page parameter enables cross-site scripting (XSS). The root cause is insufficient input handling in the affected script, allowing injection of arbitrary script/HTML by remote attackers. Public exploitation details or co...

CVE-2007-5290

CVE-2007-5290 describes multiple cross-site scripting (XSS) vulnerabilities in MailBee WebMail Pro 3.4 and earlier, and possibly MailBee WebMail Pro ASP before 3.4.64, plus WebMail Lite ASP before 4.0.11 and WebMail Lite PHP before 4.0.22. The issues allow remote attackers to inject arbitrary web...

CVE-2007-5308

The CVE-2007-5308 entry concerns SQL injection in galerie.php of PHP Homepage M (phpHPm) 1.0 when magic_quotes_gpc is disabled. Remote attackers can modify the id parameter in a show action to execute arbitrary SQL commands (impacting confidentiality, integrity, and availability). The NVD entry l...

CVE-2007-5298

CVE-2007-5298 describes multiple PHP remote file inclusion vulnerabilities in the CMS Creamotion. The flaw allows remote attackers to execute arbitrary PHP code by supplying a crafted URL in the cfg[document_uri] parameter to two admin scripts: _administration/securite.php and _administration/ges...

CVE-2007-5301

CVE-2007-5301 affects Alsaplayer's Ogg Vorbis input plugin. The vulnerability is a buffer overflow in vorbis_stream_info/vorbis_engine.c that can allow remote code execution when a malicious .OGG file with long comments is opened. Debian fixed it in DSA-1538-1 (ups/patches for 0.99.76-9+etch1 and...