CVE-2008-2763

SQL injection vulnerability in search.asp in Xigla Absolute Live Support XE 5.1 allows remote authenticated administrators to execute arbitrary SQL commands via the orderby parameter...

CVE-2008-2757

SQL injection vulnerability in search.asp in Xigla Absolute News Manager XE 3.2 allows remote authenticated administrators to execute arbitrary SQL commands via the orderby parameter...

CVE-2008-2760

SQL injection vulnerability in searchbanners.asp in Xigla Absolute Banner Manager XE 2.0 allows remote authenticated administrators to execute arbitrary SQL commands via the orderby parameter...

CVE-2008-2758

Multiple cross-site scripting XSS vulnerabilities in Xigla Absolute News Manager XE 3.2 allow remote authenticated administrators to inject arbitrary web script or HTML via the 1 pblname and 2 text parameters to a admin/search.asp, 3 name parameter to b admin/publishers.asp, and other unspecified...

CVE-2008-2761

Multiple cross-site scripting XSS vulnerabilities in Xigla Absolute Banner Manager XE 2.0 allow remote authenticated administrators to inject arbitrary web script or HTML via the text parameter in 1 searchbanners.asp and 2 listadvertisers.asp, and other unspecified fields. NOTE: some of these...

CVE-2008-2762

SQL injection vulnerability in search.asp in Xigla Absolute Form Processor XE 4.0 allows remote authenticated administrators to execute arbitrary SQL commands via the orderby parameter...

CVE-2008-2764

Cross-site scripting XSS vulnerability in admin/search.asp in Xigla Absolute Live Support XE 5.1 allows remote authenticated administrators to inject arbitrary web script or HTML via unspecified vectors "all fields"...

CVE-2008-2757

The CVE-2008-2757 entry affects Xigla Absolute News Manager XE 3.2. Affected component: search.asp. Root cause: SQL injection via the orderby parameter, enabling remote authenticated administrators to execute arbitrary SQL commands. Impact: allows manipulation of backend databases (as described),...

Sql injection

Multiple SQL injection vulnerabilities in admin/adminindex.php in Turnkey Web Tools SunShop Shopping Cart 4.1.0 allow remote authenticated administrators to execute arbitrary SQL commands via the 1 orderby and 2 sort parameters. NOTE: the provenance of this information is unknown; the details are...

CVE-2008-2038

Multiple SQL injection vulnerabilities in admin/adminindex.php in Turnkey Web Tools SunShop Shopping Cart 4.1.0 allow remote authenticated administrators to execute arbitrary SQL commands via the 1 orderby and 2 sort parameters. NOTE: the provenance of this information is unknown; the details are...

CVE-2008-1988

Unrestricted file upload vulnerability in the fileupload function in core/misc.class.php in EncapsGallery 2.0.2 allows remote authenticated administrators to upload and execute arbitrary PHP files by uploading a file with an executable extension, then accessing it via a direct request to the file...

CVE-2008-1495

Unrestricted file upload vulnerability in administrer/produits.php in PEEL, possibly 3.x and earlier, allows remote authenticated administrators to upload and execute arbitrary PHP files via a modified content type in an ajout action, as demonstrated by 1 image/gif and 2 application/pdf...

CVE-2007-6319

Multiple unspecified vulnerabilities in Lyris ListManager 8.x before 8.95d, 9.2 before 9.2c, and 9.3 before 9.3b allow remote attackers to 1 gain list administrator privileges or 2 access arbitrary mailing lists via unknown vectors related to modification of client-side information; and 3 allow...

Sql injection

SQL injection vulnerability in the administration panel in the DMSGuestbook 1.7.0 plugin for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via unspecified vectors. NOTE: it is not clear whether this issue crosses privilege boundaries...

CVE-2008-0616

SQL injection vulnerability in the administration panel in the DMSGuestbook 1.7.0 plugin for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via unspecified vectors. NOTE: it is not clear whether this issue crosses privilege boundaries...

WordPress DMSGuestbook Plugin <= 1.7.0 - SQL Injection

Because of this vulnerability in the administration panel, the authenticated administrators can execute arbitrary SQL commands via unspecified vectors. Solution Update the plugin...

Sql injection

Multiple SQL injection vulnerabilities in Coppermine Photo Gallery CPG before 1.4.15 allow remote authenticated administrators to execute arbitrary SQL commands via the 1 albumid, 2 startpic, and 3 numpics parameters to util.php; and 4 cidarray parameter to reviewcom.php...

CVE-2008-0504

Multiple SQL injection vulnerabilities in Coppermine Photo Gallery CPG before 1.4.15 allow remote authenticated administrators to execute arbitrary SQL commands via the 1 albumid, 2 startpic, and 3 numpics parameters to util.php; and 4 cidarray parameter to reviewcom.php...

CVE-2008-0504

Multiple SQL injection vulnerabilities in Coppermine Photo Gallery CPG before 1.4.15 allow remote authenticated administrators to execute arbitrary SQL commands via the 1 albumid, 2 startpic, and 3 numpics parameters to util.php; and 4 cidarray parameter to reviewcom.php...

Sql injection

Multiple SQL injection vulnerabilities in Digital Hive 2.0 RC2 and earlier allow 1 remote attackers to execute arbitrary SQL commands via the selectskin parameter to an unspecified program, or 2 remote authenticated administrators to execute arbitrary SQL commands via the userid parameter in the...