CVE-2006-0413

NewsPHP is affected by multiple SQL injection vulnerabilities in index.php, exploitable via the (1) discuss, (2) tim, (3) id, (4) last, and (5) limit parameters. Remote attackers could execute arbitrary SQL commands due to unsafely constructed inputs in these parameters. The available documents d...

CVE-2006-0415

Cross-site scripting XSS vulnerability in index.php in SleeperChat 0.3f and earlier allows remote attackers to inject arbitrary web script or HTML via the pseudo parameter...

CVE-2006-0403

Multiple SQL injection vulnerabilities in e-moBLOG 1.3 allow remote attackers to execute arbitrary SQL commands via the 1 monthy parameter to index.php or 2 login parameter to admin/index.php. NOTE: some sources have reported item 1 as involving the "monthly" parameter, but this is incorrect...

Sql injection

Multiple SQL injection vulnerabilities in e-moBLOG 1.3 allow remote attackers to execute arbitrary SQL commands via the 1 monthy parameter to index.php or 2 login parameter to admin/index.php. NOTE: some sources have reported item 1 as involving the "monthly" parameter, but this is incorrect...

CVE-2006-0409

CVE-2006-0409 describes a cross-site scripting (XSS) vulnerability in the Pixelpost Photoblog 1.4.3 implementation of index.php, exploitable via the "Add Comment" field in a comment popup. The affected component is the comment handling code in Pixelpost’s index.php, with the underlying cause bein...

CVE-2006-0403

CVE-2006-0403 affects e-moBLOG 1.3 with multiple SQL injection vulnerabilities exploitable via the (1) monthy parameter to index.php and (2) login parameter to admin/index.php. Remote attackers could execute arbitrary SQL commands. Root cause described as improper handling of user input leading t...

Directory traversal

Directory traversal vulnerability in index.php in Noah Medling RCBlog 1.03 allows remote attackers to read arbitrary .txt files, possibly including one that stores the administrator's account name and password, via a .. dot dot in the post parameter...

CVE-2006-0371

CVE-2006-0371 concerns RCBlog 1.03 (PHP) where index.php accepts a post parameter that is not properly sanitized, enabling a directory traversal attack. An attacker can use a .. in the post parameter to read arbitrary .txt files on the remote host, potentially exposing sensitive data such as the ...

CVE-2006-0333

Cross-site scripting XSS vulnerability in ar-blog 5.2 allows remote attackers to inject arbitrary web script or HTML via the 1 month or 2 year parameter to index.php...

Cross site scripting

Cross-site scripting XSS vulnerability in ar-blog 5.2 allows remote attackers to inject arbitrary web script or HTML via the 1 month or 2 year parameter to index.php...

CVE-2006-0333

CVE-2006-0333: An XSS vulnerability in ar-blog 5.2 affects index.php, exploitable via the month or year parameters. Related entry CVE-2006-2809 expands the risk to additional parameters (count, next, Year_the_news, mo); note that the month/year vectors are already covered by CVE-2006-0333. No exp...

CVE-2006-0313

Multiple SQL injection vulnerabilities in PDFdirectory before 1.0 allow remote attackers to execute arbitrary SQL commands via multiple unspecified vectors involving 1 util.php, 2 userpref.php, 3 user.php, 4 uploadfrm.php, 5 title.php, 6 team.php, 7 stats.php, 8 page.php, 9 org.php, 10 member.php...

CVE-2006-0245

Multiple cross-site scripting XSS vulnerabilities in CubeCart 3.0.7-pl1 allow remote attackers to inject arbitrary web script or HTML via the 3 redir, 4 productId, 5 docId, 6 act, and 7 catId parameters in index.php; and the 8 username field in a login action in index.php. NOTE: the cart.php/redi...

Cross site scripting

Cross-site scripting XSS vulnerability in index.php in GTP iCommerce allows remote attackers to inject arbitrary web script or HTML via the 1 cat and 2 subcat parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2006-0237

Cross-site scripting XSS vulnerability in index.php in GTP iCommerce allows remote attackers to inject arbitrary web script or HTML via the 1 cat and 2 subcat parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2006-0242

CVE-2006-0242 corresponds to a Cross-site scripting vulnerability in PHP Fusebox 4.0.6, affecting index.php where the fuseaction parameter can be used to inject arbitrary web script or HTML. The vulnerability is triggered remotely via the fuseaction parameter, enabling partial confidentiality and...

CVE-2006-0237

CVE-2006-0237 concerns a cross-site scripting (XSS) vulnerability in index.php of GTP iCommerce. The flaw allows remote attackers to inject arbitrary web script or HTML via the (1) cat and (2) subcat parameters due to inadequate input handling. They can influence the content rendered in a victim’...

Sql injection

SQL injection vulnerability in index.php in microBlog 2.0 RC-10 allows remote attackers to execute arbitrary SQL commands via the 1 month and 2 year parameters...

CVE-2006-0234

CVE-2006-0234 documents a SQL injection vulnerability in the web application component: index.php of the microBlog 2.0 RC-10 release. The underlying issue is an injection flaw that allows remote attackers to append arbitrary SQL commands via the two parameters, (1) month and (2) year. The vulnera...

CVE-2005-4656

SQL injection vulnerability in index.php in TClanPortal 1.1.3 and earlier allows remote attackers to execute arbitrary SQL commands, and retrieve all usernames and passwords, via the id parameter...