CVE-2007-6657

Affected product: Mihalism Multi Forum Host 3.0.x and earlier. The vulnerability is a PHP remote file inclusion in load_forum.php triggered by a URL in the mfh_root_path parameter, allowing remote code execution. The CVSS-based assessment in the linked NVD entry indicates a HIGH base score (7.5) ...

CVE-2007-6660

The CVE-2007-6660 entry involves the 2z project version 0.9.6.1 where information disclosure can occur via (1) a request to index.php with an invalid template or (2) a request to the default URI with certain year/month parameters, causing error messages that reveal the path. The NVD description d...

CVE-2007-6667

The CVE-2007-6667 entry describes an SQL injection in MyPHP Forum 3.0 and earlier, exploitable via the id parameter in faq.php. The vulnerability allows remote execution of arbitrary SQL commands, with the attack surface limited to the FAQ handling path; the note indicates the member.php vector i...

CVE-2007-6665

CVE-2007-6665 describes an SQL injection vulnerability in Netchemia oneSCHOOL, specifically in admin/login.asp where the txtLoginID parameter can be exploited by remote attackers to run arbitrary SQL commands. The issue is documented across multiple sources (NVD/NIST, CVE listings) as affecting t...

CVE-2007-6666

The CVE-2007-6666 issue affects Zenphoto rss.php, vulnerable in versions 1.1 through 1.1.3 via the albumnr parameter. The vulnerability is a SQL injection that allows remote attackers to execute arbitrary SQL commands through that input, potentially leading to data disclosure or modification. Ope...

CVE-2007-6661

CVE-2007-6661 affects 2z project 0.9.6.1: attackers can change the password without supplying the old password. This is the concrete vulnerability described in multiple connected records (NVD, CVE listing). No exploit specifics or remediation are provided in the documents.

CVE-2007-6664

CVE-2007-6664 is a SQL injection vulnerability in WebPortal CMS 0.6.0 and earlier. The flaw resides in the index.php handling of the m parameter, allowing remote attackers to execute arbitrary SQL commands. The NVD notes a base score of 7.5 (High) with network access, low attack complexity, and n...

CVE-2007-6654

CVE-2007-6654 is a buffer overflow in Macrovision InstallShield Update Service Web Agent 5.1.100.47363, affecting its ActiveX control. A remote attacker can execute arbitrary code by passing a long ProductCode string as the second argument to the DownloadAndExecute method. This entry is distinct ...

CVE-2007-6663

CVE-2007-6663 is a SQL injection in Pragmatic Utopia PU Arcade (com_puarcade) for Joomla! versions 2.0.3, 2.1.2, and 2.1.3 Beta. It allows remote attackers to execute arbitrary SQL commands via the fid parameter to index.php. Root cause: improper handling of the fid input leading to SQL injection...

CVE-2007-6651

CVE-2007-6651 affects Bitweaver R2 CMS, specifically the wiki/edit.php script. The vulnerability stems from inadequate sanitization of the suck_url parameter, allowing unauthenticated attackers to perform a directory traversal and read sensitive files (e.g., configuration) on the remote host. The...

CVE-2007-6598

Dovecot before 1.0.10, with certain configuration options including use of %variables, does not properly maintain the LDAP+auth cache, which might allow remote authenticated users to login as a different user who has the same password...

CVE-2007-6598

Dovecot before 1.0.10, with certain configuration options including use of %variables, does not properly maintain the LDAP+auth cache, which might allow remote authenticated users to login as a different user who has the same password...

CVE-2007-6599

CVE-2007-6599 describes a race condition in the OpenAFS fileserver that can cause a remote daemon crash (DoS) when file callbacks are acquired and returned concurrently, triggering linked-list operations without host_glock locking. Affected versions range from OpenAFS 1.3.40/1.3.50? through 1.4.5...

CVE-2007-6645

Unspecified vulnerability in Joomla! before 1.5 RC4 allows remote authenticated users to gain privileges via unspecified vectors, aka "registered user privilege escalation vulnerability."...

CVE-2007-6644

Joomla! before 1.5 RC4 allows remote authenticated administrators to promote arbitrary users to the administrator group, in violation of the intended security model...

CVE-2007-6646

CVE-2007-6646 covers multiple cross-site scripting (XSS) vulnerabilities in LiveCart 1.0.1 and possibly other versions before 1.1.0. The issues enable remote attackers to inject arbitrary script/HTML via (1) the return parameter to user/remindPassword, (2) the q parameter to the category script, ...

CVE-2007-6640

Creammonkey (0.9–1.1) and GreaseKit (1.2–1.3) expose dangerous user-scripting APIs (GM_addStyle, GM_log, GM_openInTab, GM_setValue, GM_getValue, GM_xmlhttpRequest) to web pages, allowing a remote attacker to read/modify configuration or trigger HTTP requests from a page hosting a userscript. The ...

CVE-2007-6642

CVE-2007-6642 concerns Joomla! before 1.5 RC4, with multiple CSRF vulnerabilities that allow remote attackers to perform admin-level actions via unspecified vectors, including adding a Super Admin, uploading extensions containing PHP code, and modifying configuration. The linked documents confirm...

CVE-2007-6641

CVE-2007-6641 is an XSS vulnerability in milliscripts Redirection, affecting dir.php where an attacker can inject arbitrary script/HTML by supplying the cat parameter in a browse action. The NVD entry lists a medium severity (CVSS v2: AV:N/AC:M/Au:N/C:N/I:P/A:N, base score 4.3). No exploitation d...

CVE-2007-6643

CVE-2007-6643 is a Cross-site Scripting (XSS) vulnerability in the Joomla! com_poll component, present in versions before 1.5 RC4. Remote attackers could inject arbitrary web script or HTML via unspecified vectors. The NVD entry confirms the flaw and its impact (I = Partial) with an overall MEDIU...