CVE-2009-2339: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in Rentventory allows remote attackers to execute arbitrary SQL commands via the product parameter...

CVE-2009-2332: Exposure of Sensitive Information to an Unauthorized Actor

CMS Chainuk 1.2 and earlier allows remote attackers to obtain sensitive information via 1 a crafted id parameter to index.php or 2 a nonexistent folder name in the id parameter to admin/admindelete.php, which reveals the installation path in an error message...

CVE-2009-2325: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in Clicknet CMS 2.1 allows remote attackers to read arbitrary files via a .. dot dot in the side parameter...

CVE-2009-2326: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in KerviNet Forum 1.1 and earlier allow remote attackers to execute arbitrary SQL commands via 1 an enterparol cookie to index.php in an auto action or 2 the topic parameter to message.php. NOTE: vector 2 can be leveraged for a cross-site scripting XSS attac...

Sql injection

SQL injection vulnerability in index.php in Codice CMS 2 allows remote attackers to execute arbitrary SQL commands via the tag parameter...

CVE-2009-2309

SQL injection vulnerability in index.php in Codice CMS 2 allows remote attackers to execute arbitrary SQL commands via the tag parameter...

CVE-2009-2303

CVE-2009-2303 affects Aardvark Topsites PHP 5.2.1 and earlier. The vulnerability resides in index.php during a search action, where a negative integer value for the start parameter can trigger an error message that reveals the installation path. This leads to an information disclosure risk (parti...

CVE-2009-2309

CVE-2009-2309 describes a SQL injection vulnerability in Codice CMS 2, exploitable via the tag parameter in index.php. The underlying issue is an input handling flaw that allows remote attackers to execute arbitrary SQL commands. The vulnerability is documented across multiple sources (NVD and CV...

CVE-2009-2302

CVE-2009-2302 describes a cross-site scripting (XSS) vulnerability in the PHP index.php of Aardvark Topsites PHP. The issue allows remote attackers to inject arbitrary web script or HTML via the q parameter in a search action for versions 5.2.0 and earlier, with 5.2.1 also reported as affected. T...

CVE-2009-2302: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in Aardvark Topsites PHP 5.2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the q parameter in a search action. NOTE: it was later reported that 5.2.1 is also affected...

CVE-2009-2309: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in Codice CMS 2 allows remote attackers to execute arbitrary SQL commands via the tag parameter...

CVE-2009-2303: Improper Input Validation

index.php in Aardvark Topsites PHP 5.2.1 and earlier allows remote attackers to obtain sensitive information via a negative integer value for the start parameter in a search action, which reveals the installation path in an error message...

CVE-2009-2313: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in Jinzora Media Jukebox 2.8 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the name parameter...

CVE-2008-6843: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in Fantastico, as used with cPanel 11.x, allows remote attackers to read arbitrary files via a .. dot dot in the sup3r parameter...

CVE-2009-2304: Improper Input Validation

index.php in Aardvark Topsites PHP 5.2.0 and earlier allows remote attackers to obtain sensitive information via a nonexistent account name in the u parameter in a rate action, which reveals the installation path in an error message...

CVE-2009-2289

CVE-2009-2289 is an XSS vulnerability in Arcade Trade Script 1.0 beta, impacting index.php where the q parameter in a gamelist action can be exploited to inject arbitrary script/HTML. The issue is documented in multiple sources (e.g., NVD entry) and arises from insufficient input sanitization in ...

CVE-2009-2290: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the Boy Scout Advancement combsadv component 0.3 and earlier for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a 1 account or 2 event task to index.php...

CVE-2009-2289: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in Arcade Trade Script 1.0 beta allows remote attackers to inject arbitrary web script or HTML via the q parameter in a gamelist action...

CVE-2009-2263

Directory traversal vulnerability in index.php in Awesome PHP Mega File Manager 1.0 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the page parameter. NOTE: in some environments, this can be leveraged for remote file inclusion by using a UNC share pathnam...

tsep 0.942.02 - Multiple Vulnerabilities

tsep 0.942.02 - Multiple Vulnerabilities TSEP "0" && $percent = "100" 62: $sqlins = "INSERT INTO $dbtablename alttag,display,valuepercent,imageshow,comment 63: VALUES '$alt','$display',...