CVE-2009-1748: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in index.php in Catviz 0.4.0 Beta 1 allow remote attackers to read arbitrary files via a .. dot dot in the 1 webpagesform or 2 usermanform parameter...

CVE-2008-6813: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in phpWebNews 0.2 MySQL Edition allows remote attackers to execute arbitrary SQL commands via the idkat parameter...

CVE-2009-1749: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in index.php in Catviz 0.4.0 beta 1 allow remote attackers to inject arbitrary web script or HTML via the 1 usermanform and 2 webpagesform parameters...

Sql injection

SQL injection vulnerability in the GridSupport GS Ticket System comgsticketsystem component for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in a viewCategory action to index.php...

OpenBB 1.0.6 index.php远程SQL注入漏洞

BUGTRAQ: 9300 OpenBB包含的index.php脚本对用户提交的数据缺少充分过滤，远程攻击者可以利用这个漏洞进行SQL注入攻击，可修改数据信息或获得敏感信息。 问题是index.php脚本对 CID 参数输入缺少充分过滤，可导致攻击者提交包含恶意SQL命令作为参数，会修改原来的SQL逻辑，获取数据库敏感信息，如管理员密码HASH信息，利用这些信息可能进一步控制论坛系统。 OpenBB 1.0.6 如果您不能立刻安装补丁或者升级，建议您采取以下措施以降低威胁： 在index.php文件，找到187行： $queryfcs-free; $queryforums = new...

OpenBB index.php CID参数远程SQL注入漏洞

BUGTRAQ: 7401 OpenBB包含的'index.php'脚本对输入缺少充分检查，远程攻击者可以利用这个漏洞插入任意SQL命令到数据，导致信息泄露、数据破坏。 index.php脚本对CID参数过滤不充分，攻击者只要在参数数字后增加空格值，就可以在后面追加相关的SQL命令，注入恶意SQL命令可以导致数据库信息泄露，或破坏数据库。 OpenBB 1.0.5.-1.1.0 厂商补丁： OpenBB ------ 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.openbb.co.uk/...

CVE-2009-1731: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in panel/index.php in MLFFAT 2.1 allows remote attackers to execute arbitrary SQL commands via a base64-encoded supervisor cookie...

CVE-2009-1670

user/index.php in TCPDB 3.8 does not require administrative authentication, which allows remote attackers to add admin accounts via unspecified vectors. NOTE: some of these details are obtained from third party information...

CVE-2009-1670

user/index.php in TCPDB 3.8 does not require administrative authentication, which allows remote attackers to add admin accounts via unspecified vectors. NOTE: some of these details are obtained from third party information...

CVE-2009-1670

TCPDB 3.8 is vulnerable to a security bypass where user/index.php does not require administrative authentication, allowing remote attackers to add admin accounts via unspecified vectors. This is documented in multiple sources (NVD entry CVE-2009-1670 and OpenVAS entries) with CVSS base score 7.5 ...

Sql injection

Multiple SQL injection vulnerabilities in admin/login.php in Wright Way Services Recipe Script 5 allow remote attackers to execute arbitrary SQL commands via the 1 username and 2 Password fields, as reachable from admin/index.php...

CVE-2009-1661

SQL injection vulnerability in admin/utopic.php in uTopic 1.0, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the rating parameter to index.php...

CVE-2009-1661: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/utopic.php in uTopic 1.0, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the rating parameter to index.php...

Directory traversal

Directory traversal vulnerability in index.php in Dew-NewPHPLinks 2.0 allows remote attackers to read arbitrary files via a .. dot dot in the show parameter...

CVE-2009-1624

Directory traversal vulnerability in index.php in Dew-NewPHPLinks 2.0 allows remote attackers to read arbitrary files via a .. dot dot in the show parameter...

CVE-2009-1621: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in OpenCart 1.1.8 allows remote attackers to read arbitrary files via a .. dot dot in the route parameter...

CVE-2009-1623: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in Dew-NewPHPLinks 2.0 allows remote attackers to inject arbitrary web script or HTML via the PID parameter...

CVE-2009-1624: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in Dew-NewPHPLinks 2.0 allows remote attackers to read arbitrary files via a .. dot dot in the show parameter...

CVE-2009-1625: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in Thickbox Gallery 2 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the ln parameter...

RTWebalbum 1.0.462 (AlbumID) Blind SQL Injection Exploit

Exploit for unknown platform in category web applications ======================================================== RTWebalbum 1.0.462 AlbumID Blind SQL Injection Exploit ======================================================== !/usr/bin/perl...