CVE-2009-5077: Improper Authentication

CRE Loaded before 6.2.14 allows remote attackers to bypass authentication and gain administrator privileges via vectors related to a modified PHPSELF variable, which is not properly handled by 1 includes/applicationtop.php and 2 admin/includes/applicationtop.php...

VulnCheck KEV: CVE-2009-5076

CRE Loaded before 6.2.14, and possibly other versions before 6.3.x, allows remote attackers to bypass authentication and gain administrator privileges via a request with 1 login.php or 2 passwordforgotten.php appended as the PATHINFO, which bypasses a check that uses PHPSELF, which is not properl...

CRE Loaded version 6.2 osCommerce by Pass Creat and Download Backup

Exploit for php platform in category web applications ======================================================================== CRE Loaded version = 6.2 osCommerce by Pass / Creat and Download Backup ========================================================================...

CVE-2009-1403

SQL injection vulnerability in productinfo.php in CRE Loaded 6.2 allows remote attackers to execute arbitrary SQL commands via the productsid parameter...

CVE-2009-1403

CVE-2009-1403 describes an SQL injection in CRE Loaded 6.2, specifically in product_info.php where the products_id parameter can be exploited to execute arbitrary SQL commands. The vulnerability is labeled as high risk (CVSSv2 base score 7.5) with network attack vector and no authentication requi...

CVE-2009-1403

SQL injection vulnerability in productinfo.php in CRE Loaded 6.2 allows remote attackers to execute arbitrary SQL commands via the productsid parameter...

CVE-2009-1403: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in productinfo.php in CRE Loaded 6.2 allows remote attackers to execute arbitrary SQL commands via the productsid parameter...

CRE Loaded 6.2 (products_id) SQL Injection Vulnerability

Exploit for unknown platform in category web applications ======================================================== CRE Loaded 6.2 productsid SQL Injection Vulnerability ======================================================== +-------------------------------------+ + Homepage:...

CRE Loaded 6.2 SQL Injection

+-------------------------------------+ + Homepage: http://www.creloaded.com/ + Product: CRE Loaded v6.2 + File: productinfo.php + Parameter: productid +-------------------------------------+ + SQL Injection: +...

CRE Loaded 6.2 (products_id) SQL Injection Vulnerability

No description provided by source. +-------------------------------------+ + Homepage: http://www.creloaded.com/ + Product: CRE Loaded v6.2 + File: productinfo.php + Parameter: productid +-------------------------------------+ + SQL Injection: +...

CRE Loaded 6.2 - 'products_id' SQL Injection

+-------------------------------------+ + Homepage: http://www.creloaded.com/ + Product: CRE Loaded v6.2 + File: productinfo.php + Parameter: productid +-------------------------------------+ + SQL Injection: +...

Cross site scripting

Cross-site scripting XSS vulnerability in CRE Loaded 6.2.13.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the 1 Links and 2 Links Submit pages...

Design/Logic Flaw

CRE Loaded 6.2.13.1 and earlier does not set the "Secure" attribute for cookies that are sent over HTTPS, which might allow remote attackers to sniff the cookies if they are sent over HTTP...

CVE-2008-2557

Cross-site scripting XSS vulnerability in CRE Loaded 6.2.13.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the 1 Links and 2 Links Submit pages...

CVE-2008-2557

Cross-site scripting XSS vulnerability in CRE Loaded 6.2.13.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the 1 Links and 2 Links Submit pages...

CVE-2008-2558

CRE Loaded 6.2.13.1 and earlier does not set the "Secure" attribute for cookies that are sent over HTTPS, which might allow remote attackers to sniff the cookies if they are sent over HTTP...

CVE-2008-2557

The CVE-2008-2557 entry affects CRE Loaded versions 6.2.13.1 and earlier, with a Cross-Site Scripting (XSS) vulnerability exploitable via the Links and Links Submit pages. The underlying issue is an injected web script or HTML due to improper input handling on these pages, enabling arbitrary scri...

CVE-2008-2558

CVE-2008-2558 affects CRE Loaded 6.2.13.1 and earlier. The issue is that cookies sent over HTTPS do not set the Secure attribute, potentially allowing cookie sniffing if transmitted over HTTP. Affected software: CRE Loaded 6.2.13.1 and earlier. Underlying cause: lack of Secure flag on HTTPS cooki...

PT-2008-4013 · Cre Loaded · Cre Loaded

Name of the Vulnerable Software and Affected Versions: CRE Loaded versions 6.2.13.1 and earlier Description: The issue is related to the handling of cookies over HTTPS. Specifically, the software does not set the "Secure" attribute for cookies sent over HTTPS, which could allow remote attackers t...

PT-2008-4012 · Cre Loaded · Cre Loaded

Name of the Vulnerable Software and Affected Versions: CRE Loaded versions 6.2.13.1 and earlier Description: A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the Links and Links Submit pages. Recommendations: For CRE Loaded versions 6.2.13.1 and...