CVE-2001-1188

The CVE-2001-1188 entry concerns mailto.exe in Brian Dorricott MAILTO 1.0.9 and earlier. The vulnerability arises because remote attackers can modify hidden form fields (sendto, email, server, subject, resulturl) to cause the program to send SPAM via remote servers. Affected component is the mail...

CVE-2001-1188

mailto.exe in Brian Dorricott MAILTO 1.0.9 and earlier allows remote attackers to send SPAM e-mail through remote servers by modifying the sendto, email, server, subject, and resulturl hidden form fields...

CVE-2000-0926

SmartWin CyberOffice Shopping Cart 2 aka CyberShop allows remote attackers to modify price information by changing the "Price" hidden form variable...

CVE-2000-0253

The dansie shopping cart application cart.pl allows remote attackers to modify sensitive purchase information via hidden form fields...

CVE-2000-1001

add2basket.asp in Element InstantShop allows remote attackers to modify price information via the "price" hidden form variable...

CVE-2000-0860

The CVE-2000-0860 entry concerns PHP 3 and PHP 4 file-upload handling. The vulnerability arises from RFC 1867-based file uploads where an attacker can manipulate hidden form field names that correspond to internal PHP variables, enabling reading of arbitrary files. Public documentation in connect...

CVE-2000-0926

The CVE-2000-0926 entry concerns SmartWin CyberOffice Shopping Cart 2 (CyberShop). Vulnerability: remote attackers can modify price information by altering the hidden Price form variable. Affected component: the shopping cart/web interface that processes the Price field. Impact: data integrity co...

CVE-2000-1001

add2basket.asp in Element InstantShop allows remote attackers to modify price information via the "price" hidden form variable...

CVE-2000-0860

The file upload capability in PHP versions 3 and 4 allows remote attackers to read arbitrary files by setting hidden form fields whose names match the names of internal PHP script variables...

CVE-2000-0758

The web interface for Lyris List Manager 3 and 4 allows list subscribers to obtain administrative access by modifying the value of the listadmin hidden form field...

CVE-2000-0758

The CVE-2000-0758 entry affects Lyris List Manager 3 and 4; the web interface allows subscribers to obtain administrative access by modifying the hidden form field list_admin. Root cause is insufficient server-side validation of this hidden field, enabling privilege escalation from a subscriber. ...

CVE-2000-0554

Ceilidh (the affected product) is vulnerable to a remote path disclosure vulnerability where an attacker can obtain the real filesystem path of the Ceilidh directory via the translated_path hidden form field. The CVE description and linked records indicate the vulnerability is exploitable over th...

CVE-2000-0554

Ceilidh allows remote attackers to obtain the real path of the Ceilidh directory via the translatedpath hidden form field...

CVE-2000-0102

CVE-2000-0102 concerns the SalesCart shopping cart where remote attackers can modify sensitive purchase information through hidden form fields. The issue affects SalesCart as described in multiple records; the PT-2000-1090 entry confirms the vulnerability exists in SalesCart with no publicly docu...

CVE-2000-0103

The CVE-2000-0103 entry concerns the SmartCart shopping cart application, where remote attackers can modify sensitive purchase information through hidden form fields. The core issue is the manipulation of hidden fields used in purchase workflows, enabling partial breaches of confidentiality and i...

CVE-2000-0137

The CartIt shopping cart application allows remote users to modify sensitive purchase information via hidden form fields...

CVE-2000-0136

The Cart32 shopping cart application allows remote users to modify sensitive purchase information via hidden form fields...

CVE-2000-0123

CVE-2000-0123 describes a vulnerability in the Filemaker shopping cart application where remote attackers can alter sensitive purchase information by manipulating hidden form fields. The available sources confirm the issue exists in the shopping cart component shipped with Filemaker, enabling inf...

CVE-2000-0108

CVE-2000-0108 concerns the Intellivend shopping cart application, where remote attackers can modify sensitive purchase information through hidden form fields in the application. The issue affects the Intellivend shopping cart software (specific affected versions are not provided in the connected ...

CVE-2000-0104

CVE-2000-0104 concerns the Shoptron shopping cart application. The connected PT-2000-1092 entry confirms that remote attackers could modify sensitive purchase information via hidden form fields in the Shoptron cart. The PT entry notes that affected versions are not specified and provides no remed...