CVE-2009-3118: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in mod/poll/comment.php in the vote module in Danneo CMS 0.5.2 and earlier allows remote attackers to execute arbitrary SQL commands via the comtext parameter, in conjunction with crafted comname and comtitle parameters, in a poll action to index.php, related to...

CVE-2008-7192: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in index.php in WoltLab Burning Board wBB 3.0.1, and possibly other 3.x versions, allows remote attackers to hijack the authentication of users for requests that delete private messages via the pmID parameter in a delete action in a PM page, a differe...

CVE-2009-3120: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in public/index.php in BIGACE Web CMS 2.6 allows remote attackers to inject arbitrary web script or HTML via the id parameter. NOTE: some of these details are obtained from third party information...

CVE-2009-3116: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in Uiga Church Portal allows remote attackers to execute arbitrary SQL commands via the year parameter in a calendar action...

Authentication flaw

OTManager CMS 2.4 allows remote attackers to bypass authentication and gain administrator privileges by setting the ADMINHora, ADMINLogado, and ADMINNome cookies to certain values, as reachable in Admin/index.php...

CVE-2008-7179

OTManager CMS 2.4 allows remote attackers to bypass authentication and gain administrator privileges by setting the ADMINHora, ADMINLogado, and ADMINNome cookies to certain values, as reachable in Admin/index.php...

CVE-2008-7176: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in Facil CMS 0.1RC allow remote attackers to read arbitrary files via a .. dot dot in the 1 changelang parameter to index.php or 2 modload parameter to modules.php...

CVE-2008-7183: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in eva/index.php in EVA CMS 2.3.1, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the evacaminho parameter to index.php...

CVE-2008-7179: Improper Authentication

OTManager CMS 2.4 allows remote attackers to bypass authentication and gain administrator privileges by setting the ADMINHora, ADMINLogado, and ADMINNome cookies to certain values, as reachable in Admin/index.php...

CVE-2008-7169: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Jabode horoscope extension comjabode for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a sign task to index.php...

CVE-2009-3081

CVE-2009-3081 affects the Uiga Church Portal (index.php). The vulnerability is a SQL injection in the calendar action, exploitable via the month parameter, enabling remote attackers to execute arbitrary SQL commands. Root cause and exact affected version details are not provided in the initial do...

CVE-2009-3081: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in Uiga Church Portal allows remote attackers to execute arbitrary SQL commands via the month parameter in a calendar action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-7163: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in mods/Integrated/index.php in SineCMS 2.3.5 and earlier, when registerglobals is enabled, allows remote attackers to include and execute arbitrary local files via the sineconfigindexmain parameter...

CVE-2009-3067

Cross-site scripting XSS vulnerability in index.php in Reservation Manager allows remote attackers to inject arbitrary web script or HTML via the resmanstartdate parameter...

CVE-2009-3053

Directory traversal vulnerability in the Agora comagora component 3.0.0b for Joomla! allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the action parameter to the avatars page, reachable through index.php...

Cross site scripting

Cross-site scripting XSS vulnerability in index.php in Reservation Manager allows remote attackers to inject arbitrary web script or HTML via the resmanstartdate parameter...

CVE-2009-3067

CVE-2009-3067 is a Cross-site scripting (XSS) vulnerability in index.php of Reservation Manager. It allows remote attackers to inject arbitrary web script/HTML via the resman_startdate parameter. NVD notes a Base Score of 4.3 (Medium). No explicit exploit details or fixes are provided in the conn...

CVE-2009-3054: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the Artetics.com Art Portal comartportal component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the portalid parameter to index.php...

CVE-2009-3067: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in Reservation Manager allows remote attackers to inject arbitrary web script or HTML via the resmanstartdate parameter...

CVE-2009-3041

SPIP 1.9 before 1.9.2i and 2.0.x through 2.0.8 does not use proper access control for 1 ecrire/exec/install.php and 2 ecrire/index.php, which allows remote attackers to conduct unauthorized activities related to installation and backups, as exploited in the wild in August 2009...