CVE-2008-7119

SQL injection vulnerability in item.php in WeBid auction script 0.5.4 allows remote attackers to execute arbitrary SQL commands via the id parameter...

Improper access control

WeBid auction script 0.5.4 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain SQL query logs via a direct request for logs/cron.log...

Sql injection

SQL injection vulnerability in the admin panel admin/ in WeBid auction script 0.5.4 allows remote attackers to execute arbitrary SQL commands via the username...

Cross site scripting

eledicss.php in WeBid auction script 0.5.4 allows remote attackers to modify arbitrary cascading style sheets CSS files via a certain request with the file parameter set to style.css. NOTE: this can probably be leveraged for cross-site scripting XSS attacks...

CVE-2008-7117

eledicss.php in WeBid auction script 0.5.4 allows remote attackers to modify arbitrary cascading style sheets CSS files via a certain request with the file parameter set to style.css. NOTE: this can probably be leveraged for cross-site scripting XSS attacks...

CVE-2008-7118

WeBid auction script 0.5.4 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain SQL query logs via a direct request for logs/cron.log...

CVE-2008-7119

CVE-2008-7119 is a SQL injection vulnerability affecting WeBid auction script 0.5.4, in item.php via the id parameter, allowing remote attackers to execute arbitrary SQL commands. The issue is publicly documented in NVD/NVD-derived records and is corroborated by references to exploit code (e.g., ...

CVE-2008-7117

CVE-2008-7117 affects WeBid 0.5.4: eledicss.php lets remote attackers modify arbitrary CSS files (file parameter set to style.css). This could enable cross-site scripting. No further exploit details are provided in the connected documents; no remediation is specified here.

CVE-2008-7119

SQL injection vulnerability in item.php in WeBid auction script 0.5.4 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2008-7117

eledicss.php in WeBid auction script 0.5.4 allows remote attackers to modify arbitrary cascading style sheets CSS files via a certain request with the file parameter set to style.css. NOTE: this can probably be leveraged for cross-site scripting XSS attacks...

CVE-2008-7118

WeBid auction script 0.5.4 stores sensitive information under the web root with insufficient access control, allowing remote attackers to obtain SQL query logs via a direct request for logs/cron.log. No remediation details are provided in the supplied documents; public exploit references exist bu...

CVE-2008-7116

The vulnerability CVE-2008-7116 affects WeBid auction script 0.5.4 and is an SQL injection in the admin panel (admin/). The underlying issue is injection via the username parameter, allowing remote attackers to execute arbitrary SQL commands. Affected component: admin panel; impact: arbitrary SQL...

CVE-2008-7118: Undefined Security Weakness

WeBid auction script 0.5.4 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain SQL query logs via a direct request for logs/cron.log...

CVE-2008-7116: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the admin panel admin/ in WeBid auction script 0.5.4 allows remote attackers to execute arbitrary SQL commands via the username...

WeBid 0.7.3 RC9 - Multiple Remote File Inclusions

----------------------------------------------------------------------------------------- ECHOADV104$2009 WeBid = 0.7.3 RC9 Multiple Remote File Inclution Vulnerabilities ----------------------------------------------------------------------------------------- Author : K-159 Date : March, 11 th...

WeBid 0.7.3 Remote File Inclusion

ECHOADV104$2009 ----------------------------------------------------------------------------------------- ECHOADV104$2009 WeBid = 0.7.3 RC9 Multiple Remote File Inclution Vulnerabilities ----------------------------------------------------------------------------------------- Author : K-159 Date ...

Sql injection

SQL injection vulnerability in browseproject.php in Freelance Auction Script 1.0 allows remote attackers to execute arbitrary SQL commands via the pid parameter in a pdetails action...

CVE-2008-2278

SQL injection vulnerability in browseproject.php in Freelance Auction Script 1.0 allows remote attackers to execute arbitrary SQL commands via the pid parameter in a pdetails action...

CVE-2008-2279

The CVE-2008-2279 entry concerns Freelance Auction Script 1.0 where user passwords are stored in plaintext in the tbl_users table, enabling attackers to read sensitive credentials and potentially gain privileges. The NVD entry provides a CVSS v2 base score of 5.0 (Medium) with network attack vect...

CVE-2008-2278

The CVE-2008-2278 entry concerns an SQL injection in Freelance Auction Script 1.0, exploitable via the pid parameter in a pdetails action of browseproject.php. The vulnerability enables remote attackers to execute arbitrary SQL commands and has a base CVSS v2 score of 7.5 (HIGH). Affected softwar...