CVE-2009-4739: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in index.php in SkaDate Dating allows remote attackers to execute arbitrary PHP code via a URL in the languageid parameter. NOTE: this can also be leveraged to include and execute arbitrary local files via directory traversal sequences...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in Web Server Creator - Web Portal 0.1 allow remote attackers to execute arbitrary PHP code via a URL in the 1 pg parameter to index.php and the 2 path parameter to news/form.php...

Cross site scripting

Cross-site scripting XSS vulnerability in the forum page in Web Server Creator - Web Portal 0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to index.php...

Sql injection

Multiple SQL injection vulnerabilities in index.php in phpMySport 1.4, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 v2 parameter in a member view action, 2 v1 parameter in a news action, 3 v1 parameter in an information action, 4 v2 parameter...

CVE-2010-1113

Cross-site scripting XSS vulnerability in the forum page in Web Server Creator - Web Portal 0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to index.php...

CVE-2010-1109

Multiple SQL injection vulnerabilities in index.php of phpMySport 1.4 allow remote attackers to execute arbitrary SQL commands when magic_quotes_gpc is disabled. Exploitable via several parameters across different actions: v2 in member view, v1 in news, v1 in information, and v2 in team, club, or...

CVE-2010-1105: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in cgi/index.php in AdvertisementManager 3.1.0 and 3.6 allows remote attackers to inject arbitrary web script or HTML via the usr parameter...

CVE-2010-1113: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the forum page in Web Server Creator - Web Portal 0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to index.php...

CVE-2010-1110: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in phpMySport 1.4 allows remote attackers to list arbitrary directories via a .. dot dot in the currentfolder parameter...

justVisual 2.0 - index.php Local File Inclusion

justVisual 2.0 - index.php Local File Inclusion justVisual 2.0 index.php = LFI Vulnerability +Title: justVisual 2.0 index.php Local File Vulnerability +Version: 2.0 +License: http://www.gnu.org/copyleft/gpl.html +Download: http://fh54.de/justVisual/packages/justVisual2.zip +Risk: Medium +Local: Y...

CVE-2010-1109: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in index.php in phpMySport 1.4, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 v2 parameter in a member view action, 2 v1 parameter in a news action, 3 v1 parameter in an information action, 4 v2 parameter...

CVE-2010-1114: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Web Server Creator - Web Portal 0.1 allow remote attackers to execute arbitrary PHP code via a URL in the 1 pg parameter to index.php and the 2 path parameter to news/form.php...

CVE-2010-1106: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in cgi/index.php in AdvertisementManager 3.1.0 allows remote attackers to execute arbitrary PHP code via a URL in the req parameter. NOTE: this can also be leveraged to include and execute arbitrary local files via .. dot dot sequences...

CVE-2010-1090

CVE-2010-1090 describes a SQL injection in the PHP app phpMySite via the parameter action to index.php . The root cause is improper input handling allowing remote attackers to craft SQL commands; impact per sources is arbitrary SQL execution with partial confidentiality, integrity, and availabili...

CVE-2010-1090

SQL injection vulnerability in index.php in phpMySite allows remote attackers to execute arbitrary SQL commands via the action parameter...

CVE-2010-1090: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in phpMySite allows remote attackers to execute arbitrary SQL commands via the action parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in index.php in Entry Level CMS EL CMS allows remote attackers to inject arbitrary web script or HTML via the subj parameter, which is not properly handled in a forced SQL error message. NOTE: the provenance of this information is unknown; the details are...

CVE-2010-1076

Cross-site scripting XSS vulnerability in index.php in Entry Level CMS EL CMS allows remote attackers to inject arbitrary web script or HTML via the subj parameter, which is not properly handled in a forced SQL error message. NOTE: the provenance of this information is unknown; the details are...

CVE-2010-1075

CVE-2010-1075 is an SQL injection vulnerability in the EL CMS (Entry Level CMS) where the vulnerable component is index.php . The issue allows remote attackers to execute arbitrary SQL commands through the subj parameter. The available documents do not specify the exact root cause in code, affect...

Directory traversal

Directory traversal vulnerability in the RokDownloads comrokdownloads component before 1.0.1 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. dot dot in the controller parameter to index.php...