CVE-2007-5178

contrib/mxglancesdesc.php in the mxglance 2.3.3 module for mxBB places a critical security check within a comment because of a missing comment delimiter, which allows remote attackers to conduct remote file inclusion attacks and execute arbitrary PHP code via a URL in the mxrootpath parameter...

CVE-2007-5176

Multiple cross-site scripting XSS vulnerabilities in GroupLink eHelpDesk 6.2.2 allow remote attackers to inject arbitrary web script or HTML via the 1 NADISPLAYNAME parameter in helpdesk/user/rfcreate.jsp and the 2 username and 3 LDAPError parameters in index2.jsp. NOTE: the provenance of this...

Immunity Canvas: PHPWCMS_INCLUDE

Name| phpwcmsinclude ---|--- CVE| CVE-2007-5185 Exploit Pack| CANVAS Description| phpwcms remote file include Notes| CVSS: 6.8 Repeatability: Infinite VENDOR: phpwcms CVE Url: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5185 CVE Name: CVE-2007-5185...

Immunity Canvas: SEGUE_INCLUDE

Name| segueinclude ---|--- CVE| CVE-2007-5186 Exploit Pack| CANVAS Description| Segue remote file include Notes| CVSS: 6.8 Repeatability: Infinite VENDOR: Segue CVE Url: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5186 CVE Name: CVE-2007-5186...

CVE-2007-5189

Multiple SQL injection vulnerabilities in mesadd.php in x-script GuestBook 1.3a, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 name, 2 email, 3 icq, and 4 website parameters...

CVE-2007-5188

CVE-2007-5188 affects XOOPS (uploader class) in XOOPS 2.0.17.1-RC1 and earlier. The issue is an unspecified remote upload vulnerability tied to improper upload configuration in class/uploader.php and class/mimetypes.inc.php, with a possibly incomplete blacklist that omits the .php4 extension. Con...

CVE-2007-5182

CVE-2007-5182 describes a cross-site scripting (XSS) vulnerability in the mail.asp component of Netkamp Emlak Scripti, where an attacker can inject arbitrary web script or HTML through input parameters (1) Email and potentially (2) Ad, (3) Soyad, (4) Konu, and (5) Mesaj to iletisim.asp. The conne...

CVE-2007-5174

CVE-2007-5174 describes a directory traversal vulnerability in actSite 1.56, exploitable via phpinc/news.php by providing a .. in the do parameter to include and execute local files. The NVD entry confirms the flaw, with a CVSS 2.0 base score of 7.5 (HIGH) and impact on confidentiality, integrity...

CVE-2007-5187

The CVE-2007-5187 entry describes a SQL injection vulnerability in the Expanded Calendar 2.x module for PHP-Fusion, specifically in infusions/calendar_events_panel/show_single.php, where an attacker can pass input through the sel parameter to execute arbitrary SQL commands. This is tied to remote...

CVE-2007-5187

SQL injection vulnerability in infusions/calendareventspanel/showsingle.php in the Expanded Calendar 2.x module for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the sel parameter...

CVE-2007-5189

CVE-2007-5189 concerns multiple SQL injection vulnerabilities in the file mes_add.php of the web app x-script GuestBook 1.3a . The issue arises when the PHP setting magic_quotes_gpc is disabled, allowing remote attackers to manipulate the database by injecting SQL through the parameters name, ema...

CVE-2007-5178

contrib/mxglancesdesc.php in the mxglance 2.3.3 module for mxBB places a critical security check within a comment because of a missing comment delimiter, which allows remote attackers to conduct remote file inclusion attacks and execute arbitrary PHP code via a URL in the mxrootpath parameter...

CVE-2007-5183

CVE-2007-5183 is a cross-site scripting (XSS) vulnerability in OdysseySuite, affecting Mailbox.mws (likely in version 4.0.729). The issue allows remote attackers to inject arbitrary web script or HTML via the idkey parameter. The connected documents confirm the affected component and the vulnerab...

CVE-2007-5184

CVE-2007-5184 corresponds to a format-string vulnerability in the SMBDirList function of dirlist.c in SmbFTPD 0.96. The issue allows remote attackers to execute arbitrary code via format specifiers contained in a directory name. Public references (NVD, CVE listings, and FreeBSD VuXML/OpenVAS entr...

CVE-2007-5186

Segue CMS suffers a PHP remote file inclusion via the themesdir parameter in index.php (and related themes/settings scripts) for versions 1.8.4 and earlier. The underlying issue is unsanitized input used to include PHP code in themes/program/themesettings.inc.php, which can enable arbitrary code ...

CVE-2007-5181

CVE-2007-5181 : SQL injection in detay.asp of Netkamp Emlak Scripti. The flaw allows remote attackers to execute arbitrary SQL commands via the ilan_id parameter, with reported impacts on confidentiality, integrity, and availability (partial). Base score 7.5 (HIGH) via NVD; no remediation details...

CVE-2007-5173

CVE-2007-5173 is a PHP remote file inclusion in phpBB Openid 0.2.0. The flaw resides in includes/openid/Auth/OpenID/BBStore.php where the openid_root_path parameter allows an attacker to cause the inclusion of a remote file and thereby execute arbitrary PHP code. This is triggered via a URL suppl...

CVE-2007-5185

In the provided documents, CVE-2007-5185 affects phpWCMS XT 0.0.7 BETA and earlier, describing a Remote File Inclusion flaw. The vulnerability enables remote attackers to execute arbitrary PHP code by supplying a URL via the HTML_MENU_DirPath parameter to the navigation scripts (config_HTML_MENU....

CVE-2007-5179

CVE-2007-5179 describes multiple XSS vulnerabilities in iletisim.asp of Y&K Iletisim Formu. The impact is injection of arbitrary web script/HTML via the parameters ad, sehir, yas, cins, tel, mail, and mesaj, with the note that provenance is from third-party information. Connected documents confir...

CVE-2007-5180

CVE-2007-5180 describes multiple SQL injection vulnerabilities in Ohesa Emlak Portali, allowing remote attackers to execute arbitrary SQL via (1) Kategori in satilik.asp and (2) Emlak in detay.asp. Root cause is improper input handling for these parameters, enabling unsanitized input to be embedd...