7215 matches found
[Full-disclosure] EZDatabase Directory Transversal, XSS and Path Disclosure Vulnerability
Synopsis: EZDatabase directory transversal, XSS and path disclosure vulnerability Product: EZDatabase http://www.ezdatabase.org Version: Confirmed on EZDatabase 2.1.2 Author: Josh Zlatin-Amishav Date: January 15, 2006 Background: Written in PHP and MySQL, ezDatabase is the foundation for your...
CVE-2005-4651
SQL injection vulnerability in index.php in AlstraSoft EPay Pro 2.0 allows remote attackers to execute arbitrary SQL commands via the pmodule parameter...
CVE-2006-0210
CVE-2006-0210 is a Cross-site Scripting (XSS) vulnerability in Interspire TrackPoint NX prior to 0.1. The issue occurs in index.php and allows remote attackers to inject arbitrary web script or HTML via the username parameter on the Login page. This is the concrete vulnerability described in the ...
CVE-2006-0204
Multiple cross-site scripting XSS vulnerabilities in Wordcircle 2.17 allow remote attackers to inject arbitrary web script or HTML via 1 the "Course name" field in index.php when the frm parameter has the value "mine" and 2 possibly certain other fields in unspecified scripts...
CVE-2006-0205
Multiple SQL injection vulnerabilities in Wordcircle 2.17 allow remote attackers to 1 execute arbitrary SQL commands and bypass authentication via the password field in the login action to index.php involving vlogin.php and suser.php and 2 have other unknown impact via certain other fields in...
CVE-2006-0205
Multiple SQL injection vulnerabilities in Wordcircle 2.17 allow remote attackers to 1 execute arbitrary SQL commands and bypass authentication via the password field in the login action to index.php involving vlogin.php and suser.php and 2 have other unknown impact via certain other fields in...
CVE-2006-0204
CVE-2006-0204 affects Wordcircle 2.17. The vulnerability is described as multiple cross-site scripting (XSS) flaws that allow remote attackers to inject arbitrary web script or HTML via the “Course name” field in index.php when the frm parameter has the value “mine,” and possibly additional field...
Remote file inclusion
PHP remote file include vulnerability in index.php in OrjinWeb E-commerce allows remote attackers to execute arbitrary code via a URL in the page parameter. NOTE: it is not clear, but OrjinWeb might be an application service, in which case it should not be included in CVE...
CVE-2005-4645
CVE-2005-4645 is a SQL injection vulnerability affecting 3CFR’s index.php. The flaw allows remote attackers to inject arbitrary SQL via the LangueID parameter, potentially compromising data integrity and confidentiality (as per the NVD entry with a Base Score of 7.5, HIGH). The available connecte...
CVE-2005-4646
Unspecified vulnerability in index.php in PEARLINGER Pearl Forums 2.4 allows remote attackers to include arbitrary files via the mode parameter, possibly due to a directory traversal vulnerability. NOTE: the provenance of this information is unknown; the details are obtained solely from third par...
CVE-2005-4645
SQL injection vulnerability in index.php in 3CFR allows remote attackers to execute arbitrary SQL commands via the LangueID parameter...
CVE-2005-4646
Technical details about CVE-2005-4646 are not provided in the given documents; no affected product, version, or remediation is specified. Monitor for updates.
CVE-2005-4643
CVE-2005-4643 describes an SQL injection vulnerability in index.php of Antharia OnContent // CMS, where remote attackers may inject via the pid parameter to execute arbitrary SQL commands. The note suggests the product could be hosted by an application service provider and possibly excluded from ...
Sql injection
SQL injection vulnerability in index.php in CyberDoc SiteSuite CMS allows remote attackers to execute arbitrary SQL commands via the page parameter...
CVE-2006-0158
SQL injection vulnerability in index.php in CyberDoc SiteSuite CMS allows remote attackers to execute arbitrary SQL commands via the page parameter...
CVE-2005-4640
SQL injection vulnerability in index.php in class-1 Poll Software 0.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 1 pollid or 2 previouspoll parameters...
CVE-2005-4640
The CVE-2005-4640 entry describes a SQL injection vulnerability in index.php of class-1 Poll Software 0.4 and earlier. The underlying issue is that input parameters (pollid and previouspoll) can be crafted to alter SQL commands executed by the application. This enables remote attackers to potenti...
CVE-2005-4634
CVE-2005-4634 describes an SQL injection in index.php of ActiveCampaign SupportTrio 1.4, exploitable via the page parameter. The vulnerability is documented with a high impact score (CVSS v2 base 7.5) and network access with no authentication required, causing potential unauthorized database comm...