CVE-2014-4946

The vulnerability CVE-2014-4946 affects Horde IMP (Internet Mail Program) before version 6.1.8, as deployed in Horde Groupware Webmail Edition before 5.1.5. The issue is a cross-site scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML via (1) unspecified flags...

CVE-2013-4946

CVE-2013-4946 concerns multiple XSS vulnerabilities in BMC Service Desk Express (SDE) 10.2.1.95. The affected component is the web interface, with input vectors in three parameters: SelTab (QV_admin.aspx), CallBack (QV_grid.aspx), and HelpPage (commonhelp.aspx). The root cause is cross-site scrip...

CVE-2012-4946

Agile FleetCommander and FleetCommander Kiosk before 4.08 store passwords with a reversible XOR encryption, enabling an attacker who can read the password key file and encrypted strings to obtain sensitive information. This CVE is documented by NVD and CVE records; CERT notes updates to 4.08/4.08...

CVE-2011-4946

The CVE-2011-4946 entry documents an SQL injection in the e107 CMS before version 0.7.26. Specifically, the vulnerability exists in e107_admin/users_extended.php and allows remote attackers to inject SQL via the user_field parameter, enabling arbitrary SQL execution. The connected records confirm...

CVE-2010-4946

CVE-2010-4946 describes an SQL injection in ALLPC 2.5, specifically in product_info.php where the products_id parameter can be manipulated to run arbitrary SQL. The vulnerability, as documented by NVD and Red Hat, carries a CVSS v2 base score of 7.5 (HIGH) with network access, low attack complexi...

CVE-2009-4946

CVE-2009-4946 describes a directory traversal vulnerability in Joomla!'s Messaging (com_messaging) component prior to 1.5.1. The issue allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the controller parameter of the messages action to index...

CVE-2007-4946

Technical details about CVE-2007-4946 are not publicly available in the provided documents. Monitor for updates.

Unfixed XSS vulnerability at www.uilo.ubc.ca

Security researcher CrypTIc, has submitted on 03/07/2007 a cross-site-scripting XSS vulnerability affecting www.uilo.ubc.ca, which at the time of submission ranked 4946 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 06/07/2007. It is currently...

CVE-2006-4946

PHP remote file inclusion vulnerability in include/startup.inc.php in CMSDevelopment Business Card Web Builder BCWB 0.99, and possibly 2.5 Beta and earlier, allows remote attackers to execute arbitrary PHP code via a URL in the rootpath parameter...

CVE-2006-4946

Affected product : CMSDevelopment Business Card Web Builder (BCWB). Vulnerability : PHP remote file inclusion (RFI) in include/startup.inc.php that lets an attacker supply a URL via the root_path parameter to execute arbitrary PHP. Versions/Scope : BCWB 0.99 and possibly 2.5 Beta and earlier (per...