EV0063.txt

New eVuln Advisory: PHP Event Calendar XSS & User's Data Corruption Vulnerabilities http://evuln.com/vulns/63/summary.html --------------------Summary---------------- eVuln ID: EV0063 CVE: CVE-2006-0657 Vendor: Softcomplex Vendor's Web Site: http://www.softcomplex.com/ Software: PHP Event Calenda...

[Full-disclosure] Web Calendar Pro - Denial of Service SQL Injection Vulnerability

======================================================================================= XOR Crew :: Security Advisory 1/12/2006 ======================================================================================= Web Calendar Pro - Denial of Service SQL injection lame...

[eVuln] 2200net Calendar system SQL Injection and Authentication Bypass Vulnerabilities

New eVuln Advisory: 2200net Calendar system SQL Injection and Authentication Bypass Vulnerabilities http://evuln.com/vulns/62/summary.html --------------------Summary---------------- eVuln ID: EV0062 CVE: CVE-2006-0610 Software: 2200net Calendar system Sowtware's Web Site:...

DSA-970-1 kronolith - missing input sanitising

Bulletin has no description...

Sql injection

Multiple SQL injection vulnerabilities in cms/index.php in Magic Calendar Lite 1.02, with magicquotesgpc disabled, allow remote attackers to execute arbitrary SQL commands via the 1 $totallogin and 2 $totalpassword parameter...

CVE-2006-0673

CVE-2006-0673 affects Magic Calendar Lite 1.02. The vulnerability is a SQL injection in cms/index.php, exploitable when magic_quotes_gpc is off, via the parameters $total_login and $total_password . Outcomes include unauthorized SQL command execution against the backend. Public sources (NVD and e...

CVE-2006-0673

Multiple SQL injection vulnerabilities in cms/index.php in Magic Calendar Lite 1.02, with magicquotesgpc disabled, allow remote attackers to execute arbitrary SQL commands via the 1 $totallogin and 2 $totalpassword parameter...

CVE-2006-0657

Cross-site scripting XSS vulnerability in Softcomplex PHP Event Calendar 1.5 allows remote authenticated users to inject arbitrary web script or HTML, and corrupt data, via the 1 username and 2 password parameters, which are not sanitized before being written to users.php. NOTE: while this issue...

Cross site scripting

Cross-site scripting XSS vulnerability in Softcomplex PHP Event Calendar 1.5 allows remote authenticated users to inject arbitrary web script or HTML, and corrupt data, via the 1 username and 2 password parameters, which are not sanitized before being written to users.php. NOTE: while this issue...

CVE-2006-0657

CVE-2006-0657 affects Softcomplex’s PHP Event Calendar 1.5. The issue is a vulnerability in the usernames/passwords handling, where inputs are written to users.php without sanitization, enabling potential cross‑site scripting (XSS) or direct static code injection that could corrupt data. Descript...

CVE-2006-0657

Cross-site scripting XSS vulnerability in Softcomplex PHP Event Calendar 1.5 allows remote authenticated users to inject arbitrary web script or HTML, and corrupt data, via the 1 username and 2 password parameters, which are not sanitized before being written to users.php. NOTE: while this issue...

[SA18792] PHP Event Calendar User Information Manipulation

TITLE: PHP Event Calendar User Information Manipulation SECUNIA ADVISORY ID: SA18792 VERIFY ADVISORY: http://secunia.com/advisories/18792/ CRITICAL: Less critical IMPACT: Cross Site Scripting, Manipulation of data WHERE: From remote SOFTWARE: PHP Event Calendar 1.x http://secunia.com/product/7964...

[SA18781] 2200net Calendar System SQL Injection Vulnerabilities

TITLE: 2200net Calendar System SQL Injection Vulnerabilities SECUNIA ADVISORY ID: SA18781 VERIFY ADVISORY: http://secunia.com/advisories/18781/ CRITICAL: Moderately critical IMPACT: Security Bypass, Manipulation of data WHERE: From remote SOFTWARE: 2200net Calendar System 1.x...

CVE-2006-0610

Multiple SQL injection vulnerabilities in 2200net Calendar system 1.2, with gpcmagicquotes disabled, allow remote attackers to execute arbitrary SQL commands and bypass authentication via 1 the fmdataid parameter to calendar.php and 2 the $ad'acc' variable in adminlogin.php...

Sql injection

Multiple SQL injection vulnerabilities in 2200net Calendar system 1.2, with gpcmagicquotes disabled, allow remote attackers to execute arbitrary SQL commands and bypass authentication via 1 the fmdataid parameter to calendar.php and 2 the $ad'acc' variable in adminlogin.php...

CVE-2006-0610

The CVE-2006-0610 entry relates to the 2200net Calendar system (version 1.2). Two vulnerable vectors are identified: (1) calendar.php where fm_data[id] can be injected to modify SQL queries, and (2) adminlogin.php where $ad['acc'] can be manipulated. Affected condition: magic_quotes_gpc must be o...

CVE-2006-0610

Multiple SQL injection vulnerabilities in 2200net Calendar system 1.2, with gpcmagicquotes disabled, allow remote attackers to execute arbitrary SQL commands and bypass authentication via 1 the fmdataid parameter to calendar.php and 2 the $ad'acc' variable in adminlogin.php...

PluggedOut-1.9.9c.txt

PluggedOut Blog SQL INJECTION and XSS PluggedOut Blog is an open source script you can run on your web server to give you an online multi-user journal or diary. It can be used equally well for any kind of calendar application.Rather than give you a thousand things you don't really want...

PluggedOut Blog SQL injection and XSS

PluggedOut Blog SQL INJECTION and XSS PluggedOut Blog is an open source script you can run on your web server to give you an online multi-user journal or diary. It can be used equally well for any kind of calendar application.Rather than give you a thousand things you don't really want...

EV0030.txt

New eVuln Advisory: Benders Calendar SQL Injection http://evuln.com/vulns/30/summary/bt/ --------------------Summary---------------- Software: Benders Calendar Sowtware's Web Site: http://sourceforge.net/projects/benderscalendar/ Versions: 1.0 Critical Level: Harmless Type: SQL Injection Class:...