CVE-2007-3146

Zen Help Desk 2.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing a password via a direct request for ZenHelpDesk.mdb...

My Databook - 'diary.php?delete' SQL Injection

source: https://www.securityfocus.com/bid/24311/info My DataBook is prone to multiple input-validation vulnerabilities, including cross-site scripting and SQL-injection issues. Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the...

PHP JackKnife 2.21 - '/(PHPJK) UserArea/NewAccounts/index.php?sAccountUnq' Cross-Site Scripting

source: https://www.securityfocus.com/bid/24253/info PHP JackKnife is prone to multiple input-validation vulnerabilities, including cross-site scripting and SQL-injection issues. Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the...

PHP JackKnife 2.21 - '/(PHPJK) Search/DisplayResults.php?iSearchID' SQL Injection

source: https://www.securityfocus.com/bid/24253/info PHP JackKnife is prone to multiple input-validation vulnerabilities, including cross-site scripting and SQL-injection issues. Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the...

CPCommerce 1.1 - manufacturer.php SQL Injection

CPCommerce 1.1 - manufacturer.php SQL Injection source: https://www.securityfocus.com/bid/24223/info cpCommerce is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to...

Jetbox CMS 2.1 - Multiple SQL Injections

source: https://www.securityfocus.com/bid/24077/info Jetbox is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modif...

CMS Made Simple 1.0.5 - 'Stylesheet.php' SQL Injection

source: https://www.securityfocus.com/bid/23753/info CMS Made Simple is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modi...

Burak Yilmaz Blog 1.0 - 'BRY.asp' SQL Injection

source: https://www.securityfocus.com/bid/23678/info Burak Yilmaz Blog is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or...

Phorum 5.1.20 - '/include/admin/banlist.php?delete' Cross-Site Request Forgery Banlist Deletion

source: https://www.securityfocus.com/bid/23616/info Phorum is prone to multiple input-validation vulnerabilities, including an unauthorized-access issue, privilege-escalation issue, multiple SQL-injection issues, and cross-site scripting issues, because the application fails to sufficiently...

Phorum 5.1.20 - 'admin.php?modsettings Module smiley_id' Cross-Site Scripting

source: https://www.securityfocus.com/bid/23616/info Phorum is prone to multiple input-validation vulnerabilities, including an unauthorized-access issue, privilege-escalation issue, multiple SQL-injection issues, and cross-site scripting issues, because the application fails to sufficiently...

Phorum 5.1.20 - 'admin.php' Groups Module Edit/Add Group Field SQL Injection

source: https://www.securityfocus.com/bid/23616/info Phorum is prone to multiple input-validation vulnerabilities, including an unauthorized-access issue, privilege-escalation issue, multiple SQL-injection issues, and cross-site scripting issues, because the application fails to sufficiently...

CVE-2007-2168

CVE-2007-2168 affects AimStats 3.2 and earlier. A static code injection in process.php allows remote attackers to inject PHP code into config.php via the databasehost parameter, enabling potential config tampering and partial system compromise. No remediation details are provided in the linked do...

DropAFew 0.2 - 'newaccount2.php' Arbitrary Account Creation

source: https://www.securityfocus.com/bid/23400/info DropAFew is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attacker to compromise the application, access or...

W-Agora 4.2.1 - profile.php?showuser Cross-Site Scripting

W-Agora 4.2.1 - profile.php?showuser Cross-Site Scripting source: https://www.securityfocus.com/bid/23057/info w-Agora is prone to multiple input-validation vulnerabilities, including possible SQL-injection issues and multiple cross-site scripting issues, because it fails to sufficiently sanitize...

Web Wiz Forums 8.05 - String Filtering SQL Injection

source: https://www.securityfocus.com/bid/23051/info Web Wiz Forums is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modif...

W-Agora 4.2.1 - change_password.php?userid Cross-Site Scripting

W-Agora 4.2.1 - changepassword.php?userid Cross-Site Scripting source: https://www.securityfocus.com/bid/23057/info w-Agora is prone to multiple input-validation vulnerabilities, including possible SQL-injection issues and multiple cross-site scripting issues, because it fails to sufficiently...

W-Agora 4.2.1 - 'change_password.php?userid' Cross-Site Scripting

source: https://www.securityfocus.com/bid/23057/info w-Agora is prone to multiple input-validation vulnerabilities, including possible SQL-injection issues and multiple cross-site scripting issues, because it fails to sufficiently sanitize user-supplied data. Exploiting these issues could allow a...

W-Agora 4.2.1 - 'profile.php?showuser' Cross-Site Scripting

source: https://www.securityfocus.com/bid/23057/info w-Agora is prone to multiple input-validation vulnerabilities, including possible SQL-injection issues and multiple cross-site scripting issues, because it fails to sufficiently sanitize user-supplied data. Exploiting these issues could allow a...

PHPX 3.5.15/3.5.16 - 'users.php' SQL Injection

source: https://www.securityfocus.com/bid/23033/info PHPX is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input. Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, execute arbitra...

Tyger Bug Tracking System 1.1.3 - 'ViewBugs.php?s' SQL Injection

source: https://www.securityfocus.com/bid/22799/info Tyger Bug Tracking System is prone to multiple input-validation vulnerabilities, including one SQL-injection issue and two cross-site scripting issues, because the application fails to sufficiently sanitize user-supplied input. Exploiting these...