CVE-2009-1317: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Aqua CMS 1.1, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 userSID cookie parameter to droplets/functions/base.php and the 2 username parameter to admin/index.php...

CVE-2008-6596

CVE-2008-6596 affects PHCDownload 1.1, specifically the admin/index.php component. The vulnerability is a SQL injection via the hash parameter, enabling remote attackers to execute arbitrary SQL commands. Documented impact per the CVE is partial confidentiality, integrity, and availability exposu...

CVE-2008-6596: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/index.php in PHCDownload 1.1 allows remote attackers to execute arbitrary SQL commands via the hash parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2009-1038

Multiple SQL injection vulnerabilities in YAP Blog 1.1.1 allow remote attackers to execute arbitrary SQL commands via the 1 imageid parameter to comments.php, and remote authenticated administrators to execute arbitrary SQL commands via the 2 user parameter in a modif action to admin/index.php...

CVE-2009-1038: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in YAP Blog 1.1.1 allow remote attackers to execute arbitrary SQL commands via the 1 imageid parameter to comments.php, and remote authenticated administrators to execute arbitrary SQL commands via the 2 user parameter in a modif action to admin/index.php...

CVE-2008-6348: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in DevelopItEasy Photo Gallery 1.2 allow remote attackers to execute arbitrary SQL commands via the 1 catid parameter to gallerycategory.php, 2 photoid parameter to galleryphoto.php, and the 3 username and 4 userpass parameters to admin/index.php. NOTE: some...

CVE-2008-6325: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Softbiz Classifieds Script allow remote attackers to inject arbitrary web script or HTML via the 1 radio parameter to showcategory.php, 2 msg parameter to advertisers/signinform.php, 3 radio parameter to gallery.php, 4 msg parameter to...

CVE-2008-6293: Undefined Security Weakness

admin/Index.php in Acc Real Estate 4.0 allows remote attackers to bypass authentication and gain administrative access by setting the usernamecookie to "admin."...

CVE-2008-6294: Undefined Security Weakness

admin/Index.php in Acc Statistics 1.1 allows remote attackers to bypass authentication and gain administrative access by setting the usernamecookie cookie to "admin."...

CVE-2008-6272

Dragan Mitic Apoll web app (0.7 beta and 0.7.5) contains an SQL injection in admin/index.php. The vulnerability arises from insufficient input sanitization of the pass parameter, enabling remote attackers to manipulate SQL commands. Affected component: admin/index.php; vulnerable vector is user-s...

CVE-2008-6270

SQL injection vulnerability in admin/index.php in Dragan Mitic Apoll 0.7 beta and 0.7.5 allows remote attackers to execute arbitrary SQL command via the user parameter...

CVE-2008-6270: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/index.php in Dragan Mitic Apoll 0.7 beta and 0.7.5 allows remote attackers to execute arbitrary SQL command via the user parameter...

CVE-2008-6272: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/index.php in Dragan Mitic Apoll 0.7 beta and 0.7.5 allows remote attackers to execute arbitrary SQL command via the pass parameter...

CVE-2009-0707

SQL injection vulnerability in admin/index.php in PowerClan 1.14a allows remote attackers to execute arbitrary SQL commands via the loginemail parameter aka login field. NOTE: some of these details are obtained from third party information...

CVE-2009-0707

CVE-2009-0707 is a SQL injection vulnerability in PowerClan 1.14a, specifically in admin/index.php where the loginemail parameter (login field) can be used to execute arbitrary SQL commands. The available connected documents confirm the affected component (admin/index.php), the software/version (...

CVE-2009-0707: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/index.php in PowerClan 1.14a allows remote attackers to execute arbitrary SQL commands via the loginemail parameter aka login field. NOTE: some of these details are obtained from third party information...

CVE-2008-6241: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in admin/usercheck.php in FlexPHPSite 0.0.1 and 0.0.7, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via 1 the checkuser parameter aka username field, or 2 the checkpass parameter aka password field, to...

CVE-2009-0648: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the manageusers handler in admin/index.php in Falt4 CMS aka Falt4 Extreme RC4 allow remote attackers to hijack the authentication of administrators for requests that change passwords via the 1 edit and 2 editnow actions...

CVE-2009-0597

CVE-2009-0597 describes an SQL injection in the w3b>cms (aka w3blabor CMS) admin/index.php before version 3.4.0, exploitable when magic_quotes_gpc is disabled. A remote attacker can inject SQL via the benutzername (Username) field in the login action, potentially executing arbitrary SQL comman...

CVE-2009-0597: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/index.php in w3bcms aka w3blabor CMS before 3.4.0, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the benutzername parameter aka Username field in a login action...