CVE-2006-2283

Multiple PHP remote file inclusion vulnerabilities in SpiffyJr phpRaid 2.9.5 through 3.0.b3 allow remote attackers to execute arbitrary PHP code via a URL in the phpbbrootpath parameter in 1 auth.php and 2 authphpbb when the phpBB portal is enabled, and via a URL in the smfrootpath parameter in 3...

CVE-2006-2283: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in SpiffyJr phpRaid 2.9.5 through 3.0.b3 allow remote attackers to execute arbitrary PHP code via a URL in the phpbbrootpath parameter in 1 auth.php and 2 authphpbb when the phpBB portal is enabled, and via a URL in the smfrootpath parameter in 3...

CVE-2006-1922: Undefined Security Weakness

PHP remote file inclusion vulnerability in 1 about.php or 2 auth.php in TotalCalendar allows remote attackers to execute arbitrary PHP code via a URL in the incdir parameter...

Sql injection

Multiple SQL injection vulnerabilities in Milkeyway Captive Portal 0.1 and 0.1.1 allow remote attackers to execute arbitrary SQL commands via the 1 username, 2 password, 3 team, 4 level, 5 status, 6 teamname, and 7 teamlead parameters in a auth.php; the 8 username, 9 action, and 10 filter...

CVE-2006-1289

Multiple SQL injection vulnerabilities in Milkeyway Captive Portal 0.1 and 0.1.1 allow remote attackers to execute arbitrary SQL commands via the 1 username, 2 password, 3 team, 4 level, 5 status, 6 teamname, and 7 teamlead parameters in a auth.php; the 8 username, 9 action, and 10 filter...

CVE-2006-1289: Undefined Security Weakness

Multiple SQL injection vulnerabilities in Milkeyway Captive Portal 0.1 and 0.1.1 allow remote attackers to execute arbitrary SQL commands via the 1 username, 2 password, 3 team, 4 level, 5 status, 6 teamname, and 7 teamlead parameters in a auth.php; the 8 username, 9 action, and 10 filter...

CVE-2006-0079

CVE-2006-0079 describes an SQL injection vulnerability in ScozNet ScozBook BETA 1.1, specifically in auth.php via the adminname (username) field. The underlying issue is unsanitized input allowing a remote attacker to inject arbitrary SQL commands. Documents corroborate exploitation potential and...

Sql injection

SQL injection vulnerability in auth.php in ScozNet ScozBook BETA 1.1 allows remote attackers to execute arbitrary SQL commands via the username field adminname variable...

CVE-2006-0079: Undefined Security Weakness

SQL injection vulnerability in auth.php in ScozNet ScozBook BETA 1.1 allows remote attackers to execute arbitrary SQL commands via the username field adminname variable...

CVE-2005-2723

CVE-2005-2723 refers to a SQL injection in PaFileDB 3.1’s auth.php when authmethod is configured to cookies, exploitable via the pafiledbcookie cookie username value. Multiple sources confirm the issue and indicate the remote attacker could potentially manipulate SQL commands, with at least one N...

CVE-2005-2723: Undefined Security Weakness

SQL injection vulnerability in auth.php in PaFileDB 3.1, when authmethod is set to cookies, allows remote attackers to execute arbitrary SQL commands via the username value in the pafiledbcookie cookie...

PaFileDB31SQL.txt

SePro Advisory 5 PaFileDB 3.1 - SQL-Injection =========================================================== Vendor: PhpArena URL: http://www.phparena.net/ Date: 17.08.05 App.: PaFileDB Version: 3.1 Type: SQL-Injection Risc: High Credits: ================================ Newangels &...

CVE-2005-2383: Undefined Security Weakness

SQL injection vulnerability in auth.php in PHPNews 1.2.5 allows remote attackers to execute arbitrary SQL commands via the user parameter in an HTTP POST request...

PHPNews SQL injection vulnerability

Product: PHPNews Version: 1.2.5 Release, bugfix 1.2.6 and previous URL: http://newsphp.sourceforge.net/ VULNERABILITY CLASS: SQL injection PRODUCT DESCRIPTION PHPNews is a popular script for news posting written in PHP MySQL based. VULNERABILITY Vulnerable script: auth.php code else...

CVE-2005-2000: Undefined Security Weakness

Multiple SQL injection vulnerabilities in paFileDB 3.1 and earlier allow remote attackers to execute arbitrary SQL commands via the formname parameter 1 in the login form, 2 in the team login form, or 3 to auth.php, 4 select, 5 id, or 6 query parameter to pafiledb.php, or 7 string parameter to...

CVE-2004-1932: Undefined Security Weakness

SQL injection vulnerability in 1 auth.php and 2 admin.php in PHP-Nuke 6.x through 7.2 allows remote attackers to execute arbitrary SQL code and create an administrator account via base64-encoded SQL in the admin parameter...

CVE-2001-1471

prefs.php in phpBB 1.4.0 and earlier allows remote authenticated users to execute arbitrary PHP code via an invalid language value, which prevents the variables 1 $lstatsblock in prefs.php or 2 $lprivnotify in auth.php from being properly initialized, which can be modified by the user and later...

CVE-2005-0780: Undefined Security Weakness

paFileDB 3.1 and earlier allows remote attackers to obtain sensitive information via a direct request to 1 auth.php, 2 login.php, 3 category.php, 4 file.php, 5 team.php, 6 license.php, 7 custom.php, 8 admins.php, or 9 backupdb.php, which reveal the path in a PHP error message...

CVE-2005-0632

CVE-2005-0632 concerns PHPNews, an open‑source PHP-based news application. The vulnerability is a remote file include in the script auth.php , allowing an attacker to execute arbitrary PHP code via the path parameter on PHPNews versions 1.2.4 (and possibly 1.2.3). Root cause is a missing validati...

CVE-2005-0646

CVE-2005-0646 affects paNews 2.0.4b; SQL injection via includes/auth.php using the mysql_prefix parameter allows remote attackers to execute arbitrary SQL. The NVD entry lists a base score of 7.5 (HIGH) with network access and no authentication required; impact is partial confidentiality, integri...