CVE-2009-2402

SQL injection vulnerability in index.php in the forum module in PHPEcho CMS 2.0-rc3 allows remote attackers to execute arbitrary SQL commands via the id parameter in a thread action, a different vector than CVE-2008-0355...

CVE-2009-2401

Cross-site scripting XSS vulnerability in PHPEcho CMS 2.0-rc3 allows remote attackers to inject arbitrary web script or HTML via a forum post...

CVE-2009-2401: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in PHPEcho CMS 2.0-rc3 allows remote attackers to inject arbitrary web script or HTML via a forum post...

CVE-2009-2402: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in the forum module in PHPEcho CMS 2.0-rc3 allows remote attackers to execute arbitrary SQL commands via the id parameter in a thread action, a different vector than CVE-2008-0355...

CVE-2009-2370

Cross-site scripting XSS vulnerability in Advanced Forum 5.x before 5.x-1.1 and 6.x before 6.x-1.1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2009-2385

SQL injection vulnerability in the awardsMembers function in Sources/Profile.php in the Member Awards component 1.0.2 for Simple Machines Forum SMF allows remote attackers to execute arbitrary SQL commands via the id parameter in a profile action to index.php. NOTE: some of these details are...

CVE-2009-2371

Advanced Forum 6.x before 6.x-1.1, a module for Drupal, does not prevent users from modifying user signatures after the associated comment format has been changed to an administrator-controlled input format, which allows remote authenticated users to inject arbitrary web script, HTML, and possibl...

CVE-2009-2373

Cross-site scripting XSS vulnerability in the Forum module in Drupal 6.x before 6.13 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the Forum module in Drupal 6.x before 6.13 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Sql injection

SQL injection vulnerability in the awardsMembers function in Sources/Profile.php in the Member Awards component 1.0.2 for Simple Machines Forum SMF allows remote attackers to execute arbitrary SQL commands via the id parameter in a profile action to index.php. NOTE: some of these details are...

Cross site scripting

Cross-site scripting XSS vulnerability in Advanced Forum 5.x before 5.x-1.1 and 6.x before 6.x-1.1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2009-2373

Drupal 6.x: The Forum module is vulnerable to Cross-Site Scripting (XSS) via unspecified vectors, affected up to version 6.12/6.13 (per description: before 6.13). This allows remote attackers to inject arbitrary web script or HTML. Connected advisories confirm CVE-2009-2373 and reference Drupal f...

CVE-2009-2385

SQL injection vulnerability in the awardsMembers function in Sources/Profile.php in the Member Awards component 1.0.2 for Simple Machines Forum SMF allows remote attackers to execute arbitrary SQL commands via the id parameter in a profile action to index.php. NOTE: some of these details are...

CVE-2009-2371

The CVE-2009-2371 entry affects the Drupal module Advanced Forum (6.x) prior to 6.x-1.1. The issue arises when the module allows users to modify their signatures after the comment format has been switched to an administrator-controlled input format, enabling remote authenticated users to inject a...

CVE-2009-2370

Cross-site scripting XSS vulnerability in Advanced Forum 5.x before 5.x-1.1 and 6.x before 6.x-1.1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2009-2385

CVE-2009-2385 affects Simple Machines Forum (SMF) — Member Awards component 1.0.2. The vulnerability lies in the awardsMembers function in Sources/Profile.php, where the id parameter in a profile action to index.php can be exploited to perform SQL injection and execute arbitrary SQL commands. Thi...

CVE-2009-2370

CVE-2009-2370 affects the Drupal Advanced Forum module (versions 5.x prior to 5.x-1.1 and 6.x prior to 6.x-1.1). It is an XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Connected documents corroborate the fixed versions for the vulne...

CVE-2009-2373

Cross-site scripting XSS vulnerability in the Forum module in Drupal 6.x before 6.13 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2009-2371: Undefined Security Weakness

Advanced Forum 6.x before 6.x-1.1, a module for Drupal, does not prevent users from modifying user signatures after the associated comment format has been changed to an administrator-controlled input format, which allows remote authenticated users to inject arbitrary web script, HTML, and possibl...

CVE-2009-2370: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Advanced Forum 5.x before 5.x-1.1 and 6.x before 6.x-1.1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...