Authentication flaw

OTManager CMS 2.4 allows remote attackers to bypass authentication and gain administrator privileges by setting the ADMINHora, ADMINLogado, and ADMINNome cookies to certain values, as reachable in Admin/index.php...

CVE-2008-7179

OTManager CMS 2.4 allows remote attackers to bypass authentication and gain administrator privileges by setting the ADMINHora, ADMINLogado, and ADMINNome cookies to certain values, as reachable in Admin/index.php...

CVE-2008-7179: Improper Authentication

OTManager CMS 2.4 allows remote attackers to bypass authentication and gain administrator privileges by setting the ADMINHora, ADMINLogado, and ADMINNome cookies to certain values, as reachable in Admin/index.php...

CVE-2008-7062: Undefined Security Weakness

Unrestricted file upload vulnerability in admin/index.php in Download Manager module 1.0 for LoveCMS 1.6.2 Final allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in uploads/...

CVE-2009-2393: Undefined Security Weakness

admin/index.php in Virtuenetz Virtue Online Test Generator does not require administrative privileges, which allows remote authenticated users to have an unknown impact via unspecified vectors...

CVE-2009-2388: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/index.php in Opial 1.0 allows remote attackers to execute arbitrary SQL commands via the txtPassword parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2009-2340

CVE-2009-2340 affects Opial 1.0: the admin/index.php module is vulnerable to SQL injection via the txtUserName (User Name) parameter, enabling remote execution of arbitrary SQL commands. Some sources also mention txtPassword and other parameters, but the core detail is the improper input filterin...

CVE-2009-2340: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/index.php in Opial 1.0 allows remote attackers to execute arbitrary SQL commands via the txtUserName aka User Name parameter. NOTE: some of these details are obtained from third party information...

tsep 0.942.02 - Multiple Vulnerabilities

tsep 0.942.02 - Multiple Vulnerabilities TSEP "0" && $percent = "100" 62: $sqlins = "INSERT INTO $dbtablename alttag,display,valuepercent,imageshow,comment 63: VALUES '$alt','$display',...

CVE-2009-2018

CVE-2009-2018 is a SQL injection vulnerability in the admin/index.php of Jared Eckersley’s MyCars. When magic_quotes_gpc is disabled, an attacker can craft the authuserid parameter to execute arbitrary SQL commands. The NVD entry rates it as a Medium impact (CVSSv2 6.8) with partial impact on con...

CVE-2009-2018: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/index.php in Jared Eckersley MyCars, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the authuserid parameter...

CVE-2009-1813

Multiple SQL injection vulnerabilities in admin/index.php in Submitter Script 2 allow remote attackers to execute arbitrary SQL commands via 1 the uNev parameter aka the username field or 2 the uJelszo parameter aka the Password field...

CVE-2009-1813

CVE-2009-1813 affects Submitter Script 2, specifically the admin/index.php component. It is vulnerable to SQL injection through two parameters, uNev (username) and uJelszo (password), allowing remote attackers to execute arbitrary SQL commands. The NVD entry lists a CVSS v2 base score of 7.5 (HIG...

CVE-2009-1813: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in admin/index.php in Submitter Script 2 allow remote attackers to execute arbitrary SQL commands via 1 the uNev parameter aka the username field or 2 the uJelszo parameter aka the Password field...

CVE-2009-1804

Multiple SQL injection vulnerabilities in admin/index.php in VideoScript.us YouTube Video Script allow remote attackers to execute arbitrary SQL commands via the 1 username and 2 password parameters...

CVE-2009-1804

CVE-2009-1804 refers to multiple SQL injection vulnerabilities in VideoScript.us YouTube Video Script, specifically in admin/index.php, where the attacker can manipulate the (1) username and (2) password parameters to execute arbitrary SQL commands remotely. The affected software/function is the ...

CVE-2009-1804: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in admin/index.php in VideoScript.us YouTube Video Script allow remote attackers to execute arbitrary SQL commands via the 1 username and 2 password parameters...

Sql injection

Multiple SQL injection vulnerabilities in admin/login.php in Wright Way Services Recipe Script 5 allow remote attackers to execute arbitrary SQL commands via the 1 username and 2 Password fields, as reachable from admin/index.php...

CVE-2009-1458: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in admin/index.php in razorCMS before 0.4 allow remote attackers to inject arbitrary web script or HTML via 1 the slab parameter in an edit action, 2 the catname parameter in a showcats action, and 3 the cat parameter in a reordercat action...

Sql injection

Multiple SQL injection vulnerabilities in admin/usercheck.php in FlexPHPLink Pro 0.0.6 and 0.0.7, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via 1 the checkuser parameter aka username field, or 2 the checkpass parameter aka password field, to...