355 matches found
Sql injection
SQL injection vulnerability in inclistnews.asp in CodeAvalanche News 1.x allows remote attackers to execute arbitrary SQL commands via the CATID parameter...
CVE-2007-1021
The CVE-2007-1021 entry concerns CodeAvalanche News 1.x, where a SQL injection flaw in inc_listnews.asp allows remote attackers to execute arbitrary SQL commands via the CAT_ID parameter. The underlying issue is improper handling/validation of CAT_ID, enabling crafted input to affect the database...
CVE-2007-1021: Undefined Security Weakness
SQL injection vulnerability in inclistnews.asp in CodeAvalanche News 1.x allows remote attackers to execute arbitrary SQL commands via the CATID parameter...
CodeAvalanche News 1.x (CAT_ID) Remote SQL Injection Vulnerability
No description provided by source. CodeAvalanche News SQL Injection Software: CodeAvalanche News Download: http://www.aspindir.com/indir.asp?id=3315 Risk: High Found by: beks http://target/path/inclistnews.asp?CATID=17+union+select+0,0,0,0,Password+from+Params...
CodeAvalanche News 1.x - CAT_ID SQL Injection
CodeAvalanche News 1.x - CATID SQL Injection CodeAvalanche News SQL Injection Software: CodeAvalanche News Download: http://www.aspindir.com/indir.asp?id=3315 Risk: High Found by: beks http://target/path/inclistnews.asp?CATID=17+union+select+0,0,0,0,Password+from+Params milw0rm.com 2007-02-15...
CodeAvalanche News 1.x - 'CAT_ID' SQL Injection
CodeAvalanche News SQL Injection Software: CodeAvalanche News Download: http://www.aspindir.com/indir.asp?id=3315 Risk: High Found by: beks http://target/path/inclistnews.asp?CATID=17+union+select+0,0,0,0,Password+from+Params milw0rm.com 2007-02-15...
CVE-2006-6208
Multiple SQL injection vulnerabilities in Enthrallweb eClassifieds allow remote attackers to execute arbitrary SQL commands via the 1 ADID, 2 catid, 3 subid, and 4 adid parameters to a ad.asp, the 5 cid parameter to b dircat.asp, and the 6 sid parameter to c dirSub.asp...
CVE-2006-6074
Multiple SQL injection vulnerabilities in Enthrallweb eShopping Cart allow remote attackers to execute arbitrary SQL commands via 1 the ProductID parameter in a reviews.asp, or the 2 catid or 3 subid parameter in b subProducts.asp. NOTE: the productdetail.asp vector is already covered by another...
CVE-2006-3474
Multiple SQL injection vulnerabilities in Belchior Foundry vCard PRO allow remote attackers to execute arbitrary SQL commands via the 1 catid parameter to a gbrowse.php, 2 cardid parameter to b rating.php and c create.php, and the 3 eventid parameter to d search.php...
CVE-2006-3494: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in Buddy Zone 1.0.1 allow remote attackers to inject arbitrary HTML and web script via the 1 catid parameter to a viewclassifieds.php; 2 id parameter in b viewad.php; 3 eventid parameter in c viewevent.php, d deleteevent.php, and e editevent.php;...
CVE-2006-3358: Undefined Security Weakness
Multiple cross-site scripting XSS vulnerabilities in index.php in NewsPHP 2006 PRO allow remote attackers to inject arbitrary web script or HTML via the 1 words, 2 id, 3 catid, and 4 tim parameters, which are not sanitized before being returned in an error page. NOTE: it is possible that some of...
CVE-2006-3027: Undefined Security Weakness
Multiple SQL injection vulnerabilities in Enthrallwebe ePhotos 2.2 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 CATID parameter in a subphotos.asp and b subLevel2.asp, the 2 ALID parameter in c photo.asp, and the 3 SUBID parameter in d subLevel2.asp...
CVE-2006-2339: Undefined Security Weakness
SQL injection vulnerability in index.php in evoTopsites 2.x and evoTopsites Pro 2.x allows remote attackers to execute arbitrary SQL commands via the 1 catid and 2 id parameters...
CVE-2006-2079
CVE-2006-2079 describes a cross-site scripting (XSS) vulnerability in Verosky Media Instant Photo Gallery, specifically in portfolio.php, potentially affecting versions before 1.0.2. The flaw is exploitable via the cat_id parameter, enabling remote attackers to inject arbitrary web script or HTML...
CVE-2006-2079
Cross-site scripting XSS vulnerability in portfolio.php in Verosky Media Instant Photo Gallery, possibly before 1.0.2, allows remote attackers to inject arbitrary web script or HTML via the catid parameter...
CVE-2006-2079: Undefined Security Weakness
Cross-site scripting XSS vulnerability in portfolio.php in Verosky Media Instant Photo Gallery, possibly before 1.0.2, allows remote attackers to inject arbitrary web script or HTML via the catid parameter...
CVE-2006-1970
Cross-site scripting XSS vulnerability in classifieds/viewcat.cgi in KCScripts Classifieds, distributed individually and as part of Portal Pack 6.0 and earlier, allows remote attackers to inject arbitrary web script or HTML via the catid parameter...
CVE-2006-1970: Undefined Security Weakness
Cross-site scripting XSS vulnerability in classifieds/viewcat.cgi in KCScripts Classifieds, distributed individually and as part of Portal Pack 6.0 and earlier, allows remote attackers to inject arbitrary web script or HTML via the catid parameter...