CVE-2005-3744: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in phpComasy 0.7.5 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: an examination of the 0.7.5 source code suggests that there is no id parameter being handled directly by index.php...

CVE-2005-3555: Undefined Security Weakness

Multiple SQL injection vulnerabilities in PHPlist 2.10.1 and earlier allow authenticated remote attackers with administrator privileges to execute arbitrary SQL commands via the id parameter in the 1 editattributes or 2 admin page...

CVE-2005-3638: Undefined Security Weakness

Cross-site scripting XSS vulnerabilities in Ekinboard 1.0.3 allow remote attackers to inject arbitrary web script or HTML via the 1 id parameter in profile.php and 2 titles of posts...

CVE-2005-3575: Undefined Security Weakness

SQL injection vulnerability in show.php in Cyphor 0.19 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2005-3515: Undefined Security Weakness

Cross-site scripting XSS vulnerability in recommend.php in Chipmunk Topsites script allows remote attackers to inject arbitrary web script or HTML via the ID parameter...

CVE-2005-3478: Undefined Security Weakness

SQL injection vulnerability in index.php in PHPCafe.net Tutorials Manager 1.0 Beta 2 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2005-3131

Multiple cross-site scripting XSS vulnerabilities in MERAK Mail Server 8.2.4r with Icewarp Web Mail 5.5.1, and possibly earlier versions, allow remote attackers to inject arbitrary web script or HTML via the 1 id parameter to blank.html, or the createdataCX parameter to 2 calendard.html, 3...

CVE-2005-2818: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in DownFile 1.3 allows remote attackers to inject arbitrary web script or HTML via the id parameter to 1 email.php,2 index.php, 3 del.php, or 4 addform.php...

CVE-2004-2358: Undefined Security Weakness

Cross-site scripting XSS vulnerability in adminwords.php for phpBB 2.0.6c allows remote attackers to inject arbitrary web script or HTML via the id parameter...

CVE-2005-2486: Undefined Security Weakness

SQL injection vulnerability in modforum/readmessage.php in PortailPHP allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php with the affiche parameter set to "Forum-readmess", a different vulnerability than CVE-2005-1701...

CVE-2005-2404: Undefined Security Weakness

SQL injection vulnerability in sendcard.php in Sendcard 3.2.3 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2002-2055: Undefined Security Weakness

Cross-site scripting XSS vulnerability in userlog.php in TeeKai Tracking Online 1.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter...

CVE-2005-2168

delete.php in Plague News System 0.6 and earlier allows remote unauthenticated attackers to delete news, comments, and shoutbox posts by modifying the id parameter...

CVE-2005-2168

Plague News System 0.6 and earlier is affected. The delete.php file allows remote unauthenticated attackers to delete news, comments, and shoutbox posts by modifying the id parameter, due to an insufficient authorization/authentication check in delete.php. Impact is unauthorized content deletion....

CVE-2005-2147: Undefined Security Weakness

Trac before 0.8.4 allows remote attackers to read or upload arbitrary files via a full pathname in the id parameter to the 1 upload or 2 attachment viewer scripts...

CVE-2005-2168: Undefined Security Weakness

delete.php in Plague News System 0.6 and earlier allows remote unauthenticated attackers to delete news, comments, and shoutbox posts by modifying the id parameter...

CVE-2005-2053: Undefined Security Weakness

Just another flat file JAF CMS before 3.0 Final allows remote attackers to obtain sensitive information via 1 an asterisk in the id parameter, 2 a blank id parameter, or 3 an asterisk in the disp parameter to index.php, which reveals the path in an error message. NOTE: a followup suggests that th...

CVE-2005-1525

SQL injection vulnerability in configsettings.php for Cacti before 0.8.6e allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2005-1525: Undefined Security Weakness

SQL injection vulnerability in configsettings.php for Cacti before 0.8.6e allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2005-2003

Ultimate PHP Board UPB 1.9.6 GOLD allows remote attackers to obtain sensitive information via an invalid zero id parameter to 1 viewtopic.php, 2 profile.php, or 3 newpost.php, which reveals the path in an error message...