CVE-2009-3308

FanUpdate 2.2.1 is affected by CVE-2009-3308: show-cat.php is vulnerable to SQL injection via the listingid parameter, enabling remote attackers to run arbitrary SQL commands. The NVD entry lists a base score of 7.5 (HIGH) with network vector and low complexity. No explicit remediation in the pro...

CVE-2009-3308

SQL injection vulnerability in show-cat.php in FanUpdate 2.2.1 allows remote attackers to execute arbitrary SQL commands via the listingid parameter...

CVE-2009-3308

creationtimestamp| type| source ---|---|--- 2009-09-18 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/9719...

CVE-2008-3308

CVE-2008-3308 : PHP remote file inclusion in cuenta/cuerpo.php of C. Desseno YouTube Blog (ytb) 0.1. When register_globals is enabled, an attacker can provide a URL in the base_archivo parameter to execute arbitrary PHP code on the server. Affected scenario: vulnerable 0.1 with register_globals. ...

CVE-2008-3308

creationtimestamp| type| source ---|---|--- 2008-07-22 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/6117...

Design/Logic Flaw

Simple Machines Forum SMF, probably 1.1.4, relies on "randomly generated static" to hinder brute-force attacks on the WAV file aka audio CAPTCHA, which allows remote attackers to pass the CAPTCHA test via an automated attack that considers Hamming distances. NOTE: this issue reportedly exists...

CVE-2007-3308

The CVE-2007-3308 entry concerns Simple Machines Forum (SMF) version 1.1.2, where the WAV file CAPTCHA is created by a concatenation method with insufficient randomization. This flaw allows remote attackers to bypass the CAPTCHA via automated brute-force attempts. The provided records indicate no...

CVE-2006-3308

CVE-2006-3308 affects the wpprop component of Project EROS bbsengine prior to 20060622-0315. The vulnerability’s impact is not clearly quantified in the provided documents, but remote attack vectors via [img] tags are noted with a possible cross-site scripting (XSS) effect. The NVD entry assigns ...

CVE-2005-3308

Multiple cross-site scripting XSS vulnerabilities in Zomplog 3.4 allow remote attackers to inject arbitrary web script or HTML via the 1 name or 2 comment parameter in detail.php, 3 the username parameter in get.php, and 4 the search parameter in index.php...

CVE-2005-3308

The CVE-2005-3308 entry describes multiple cross-site scripting (XSS) vulnerabilities in Zomplog 3.4. The affected components are detail.php (name and comment parameters), get.php (username parameter), and index.php (search parameter). The root cause is insufficient input sanitization allowing in...