CodeAvalanche News 1.x - CAT_ID SQL Injection

CodeAvalanche News 1.x - CATID SQL Injection CodeAvalanche News SQL Injection Software: CodeAvalanche News Download: http://www.aspindir.com/indir.asp?id=3315 Risk: High Found by: beks http://target/path/inclistnews.asp?CATID=17+union+select+0,0,0,0,Password+from+Params milw0rm.com 2007-02-15...

CodeAvalanche News 1.x - 'CAT_ID' SQL Injection

CodeAvalanche News SQL Injection Software: CodeAvalanche News Download: http://www.aspindir.com/indir.asp?id=3315 Risk: High Found by: beks http://target/path/inclistnews.asp?CATID=17+union+select+0,0,0,0,Password+from+Params milw0rm.com 2007-02-15...

CVE-2006-6208

Multiple SQL injection vulnerabilities in Enthrallweb eClassifieds allow remote attackers to execute arbitrary SQL commands via the 1 ADID, 2 catid, 3 subid, and 4 adid parameters to a ad.asp, the 5 cid parameter to b dircat.asp, and the 6 sid parameter to c dirSub.asp...

CVE-2006-6074

Multiple SQL injection vulnerabilities in Enthrallweb eShopping Cart allow remote attackers to execute arbitrary SQL commands via 1 the ProductID parameter in a reviews.asp, or the 2 catid or 3 subid parameter in b subProducts.asp. NOTE: the productdetail.asp vector is already covered by another...

CVE-2006-3474

Multiple SQL injection vulnerabilities in Belchior Foundry vCard PRO allow remote attackers to execute arbitrary SQL commands via the 1 catid parameter to a gbrowse.php, 2 cardid parameter to b rating.php and c create.php, and the 3 eventid parameter to d search.php...

CVE-2006-3494: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Buddy Zone 1.0.1 allow remote attackers to inject arbitrary HTML and web script via the 1 catid parameter to a viewclassifieds.php; 2 id parameter in b viewad.php; 3 eventid parameter in c viewevent.php, d deleteevent.php, and e editevent.php;...

CVE-2006-3358: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in index.php in NewsPHP 2006 PRO allow remote attackers to inject arbitrary web script or HTML via the 1 words, 2 id, 3 catid, and 4 tim parameters, which are not sanitized before being returned in an error page. NOTE: it is possible that some of...

CVE-2006-3027: Undefined Security Weakness

Multiple SQL injection vulnerabilities in Enthrallwebe ePhotos 2.2 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 CATID parameter in a subphotos.asp and b subLevel2.asp, the 2 ALID parameter in c photo.asp, and the 3 SUBID parameter in d subLevel2.asp...

CVE-2006-2339: Undefined Security Weakness

SQL injection vulnerability in index.php in evoTopsites 2.x and evoTopsites Pro 2.x allows remote attackers to execute arbitrary SQL commands via the 1 catid and 2 id parameters...

CVE-2006-2079

Cross-site scripting XSS vulnerability in portfolio.php in Verosky Media Instant Photo Gallery, possibly before 1.0.2, allows remote attackers to inject arbitrary web script or HTML via the catid parameter...

CVE-2006-2079

CVE-2006-2079 describes a cross-site scripting (XSS) vulnerability in Verosky Media Instant Photo Gallery, specifically in portfolio.php, potentially affecting versions before 1.0.2. The flaw is exploitable via the cat_id parameter, enabling remote attackers to inject arbitrary web script or HTML...

CVE-2006-2079: Undefined Security Weakness

Cross-site scripting XSS vulnerability in portfolio.php in Verosky Media Instant Photo Gallery, possibly before 1.0.2, allows remote attackers to inject arbitrary web script or HTML via the catid parameter...

CVE-2006-1970

Cross-site scripting XSS vulnerability in classifieds/viewcat.cgi in KCScripts Classifieds, distributed individually and as part of Portal Pack 6.0 and earlier, allows remote attackers to inject arbitrary web script or HTML via the catid parameter...

CVE-2006-1970: Undefined Security Weakness

Cross-site scripting XSS vulnerability in classifieds/viewcat.cgi in KCScripts Classifieds, distributed individually and as part of Portal Pack 6.0 and earlier, allows remote attackers to inject arbitrary web script or HTML via the catid parameter...

Sql injection

SQL injection vulnerability in rss.php in RedBLoG 0.5 allows remote attackers to execute arbitrary SQL commands via the catid parameter...

CVE-2006-1140

SQL injection vulnerability in rss.php in RedBLoG 0.5 allows remote attackers to execute arbitrary SQL commands via the catid parameter...

CVE-2006-1140

SQL injection vulnerability in rss.php in RedBLoG 0.5 allows remote attackers to execute arbitrary SQL commands via the catid parameter...

CVE-2006-1140

The CVE describes a SQL injection in RedBLoG 0.5’s rss.php, exploitable via the cat_id parameter to allow remote execution of arbitrary SQL commands. Affected software: RedBLoG 0.5; vulnerability cause: unsanitized input leading to SQL injection. Impact per NVD: Partial confidentiality/integrity/...

CVE-2006-1140: Undefined Security Weakness

SQL injection vulnerability in rss.php in RedBLoG 0.5 allows remote attackers to execute arbitrary SQL commands via the catid parameter...

CVE-2005-4304: Undefined Security Weakness

index.php in ezDatabase 2.1.2 and earlier allows remote attackers to obtain sensitive information via an invalid catid parameter, which leaks the full pathname in an error message. NOTE: these details are uncertain because the original report has terminology problems and lack of relevant details...