TrailScout Module For Drupal Session Cookie SQL Injection

The remote host is running TrailScout, a third-party module for Drupal that displays a breadcrumb-like trail showing pages a user recently visited on a site. The version of the TrailScout module installed on the remote host fails to sanitize user-supplied input to the session cookie before using ...

nBill component for Joomla! 'cid' Parameter SQLi

The version of the nBill also known as netinvoice component for Joomla! and Mambo running on the remote host is affected by a SQL injection vulnerability due to improper sanitization of user-supplied input to the 'cid' parameter before using it to construct database queries. Regardless of the PHP...

AEC Subscription Manager Component for Mambo / Joomla! 'usage' Parameter SQLi

The version of the AEC Subscription Manager component for Joomla! and Mambo running on the remote host is affected by a SQL injection vulnerability in the acctexp.class.php script due to improper sanitization of user-supplied input to the 'usage' parameter before using it to construct database...

DatsoGallery Component for Joomla! sub_votepic.php User-Agent HTTP Header SQLi

The version of the DatsoGallery component for Joomla! or Mambo running on the remote host is affected by a SQL injection vulnerability in subvotepic.php due to improper sanitization of user-supplied input to the User-Agent header before using it to construct database queries. Regardless of the PH...

Webhosting Component for Joomla! 'catid' Parameter SQLi

The version of the Webhosting component for Joomla! running on the remote host is affected by a SQL injection vulnerability in webhosting.php due to improper sanitization of user-supplied input to the 'catid' parameter before using it to construct database queries in the showoverview function...

MyBlog 1.x - SQL Injection Remote File Inclusion

MyBlog 1.x - SQL Injection Remote File Inclusion source: https://www.securityfocus.com/bid/28313/info MyBlog is prone to multiple input-validation vulnerabilities, including: - Multiple SQL-injection vulnerabilities - Multiple remote file-include vulnerabilities - A privilege-escalation...

MyBlog 1.x - SQL Injection / Remote File Inclusion

source: https://www.securityfocus.com/bid/28313/info MyBlog is prone to multiple input-validation vulnerabilities, including: - Multiple SQL-injection vulnerabilities - Multiple remote file-include vulnerabilities - A privilege-escalation vulnerability An attacker may exploit these issues to...

Acajoom Component for Joomla! 'mailingid' Parameter SQLi

The version of the Acajoom component for Joomla! running on the remote host is affected by a SQL injection vulnerability in the class.mailing.php script due to improper sanitization of user-supplied input to the 'mailingid' parameter before using it to construct database queries in the...

Cacti index.php/sql.php Login Action login_username Parameter SQL Injection

The remote host is running Cacti, a web-based front-end to RRDTool for network graphing. The version of Cacti installed on the remote host fails to sanitize user input to the 'loginusername' parameter before using it in the 'authlogin.php' script to perform database queries. Regardless of PHP's...

AkoGallery Component for Mambo / Joomla! 'id' Parameter SQLi

The version of the AkoGallery component for Joomla! running on the remote host is affected by a SQL injection vulnerability in the akogallery.php script due to improper sanitization of user-supplied input to the 'id' parameter before using it to construct database queries in the GalleryHeader...

CandyPress Store admin/utilities_ConfigHelp.asp helpfield Parameter SQL Injection

The remote host is running CandyPress, a commercial shopping cart script written in ASP. The version of CandyPress installed on the remote host fails to sanitize user-supplied input to the 'helpfield' parameter of the 'admin/utilitiesConfigHelp.asp' script before using it to perform database...

Pixelpost index.php parent_id Parameter SQL Injection

The remote host is running Pixelpost, a photo blog application based on PHP and MySQL. The version of Pixelpost installed on the remote host fails to sanitize input to the 'parentid' parameter of the 'index.php' script before using it to perform database queries. Provided PHP's 'magicquotesgpc'...

X7 Chat index.php day Parameter SQL Injection

The remote host is running X7 Chat, a web-based chat program written in PHP. The version of X7 Chat installed on the remote host fails to sanitize input to the 'day' parameter of the 'index.php' script when 'page' is set to 'event' before using it in 'sources/infobox.php' to construct database...

CVE-2007-6667

SQL injection vulnerability in faq.php in MyPHP Forum 3.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: the member.php vector is already covered by CVE-2005-0413...

XOOPS 2.0.17.1 Mylinks Module - 'Brokenlink.php' SQL Injection

source: https://www.securityfocus.com/bid/26392/info Xoops Mylinks module is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. Exploiting this vulnerability could permit remote attackers to pass maliciou...

XOOPS 2.0.17.1 Mylinks Module - Brokenlink.php SQL Injection

XOOPS 2.0.17.1 Mylinks Module - Brokenlink.php SQL Injection source: https://www.securityfocus.com/bid/26392/info Xoops Mylinks module is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. Exploiting this...

QuickEStore insertorder.cfm CFTOKEN Parameter SQL Injection

The remote host is running QuickEStore, a shopping cart application writtein in Cold Fusion. The version of QuickEStore installed on the remote host fails to sanitize input to the 'CFTOKEN' parameter of the 'insertorder.cfm' script before using it in database queries. An unauthenticated attacker...

SimpleFAQ Component for Joomla! 'aid' Parameter SQLi

The version of the SimpleFAQ component for Joomla! and Mambo running on the remote host is affected by a SQL injection vulnerability in the simplephp.php script due to improper sanitization of user-supplied input to the 'aid' parameter before using it to construct database queries in the...

GMaps Component for Joomla! 'mapId' Parameter SQLi

The version of the GMaps component for Joomla! running on the remote host is affected by a SQL injection vulnerability in the classes/gmapdao.class.php script due to improper sanitization of user-supplied input to the 'mapId' parameter before using it to construct database queries in the getMap...

MailMarshal Spam Quarantine Interface Arbitrary Account Password Retrieval

The remote host is running the Spam Quarantine Management web component of MailMarshal SMTP, a mail server for Windows. The version of the Spam Quarantine Management web component installed on the remote host fails to sanitize input to the 'emailTextBox' parameter of the 'Register.aspx' script...