CVE-2009-1277: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in Gravity Board X GBX 2.0 BETA allows remote attackers to execute arbitrary SQL commands via the memberid parameter in a viewprofile action. NOTE: the boardid issue is already covered by CVE-2008-2996.2...

Joomla Maian Music 1.2.1 SQL Injection

Joomla Component MaianMusic SQL Injection Vulnerability Vulnerability found by: Valon Kerolli Contact: valonatitshqip.com Site: www.itshqip.com ScriptName: "Joomla" Component: "MaianMusic commaianmusic" Version: "1.2.1" Date: "09-26-2008" Author: "Arelowo Alao & David Bennett" Author E-mail:...

CVE-2009-1258

SQL injection vulnerability in the RD-Autos comrdautos component 1.5.7 for Joomla! allows remote attackers to execute arbitrary SQL commands via the makeid parameter in index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2009-1258

CVE-2009-1258 is a SQL injection vulnerability in the RD-Autos (com_rdautos) Joomla! component, version 1.5.7. The flaw allows remote attackers to execute arbitrary SQL commands via the makeid parameter in index.php. The incident is described with a CVSS 2.0 base score of 7.5 (HIGH) with network ...

CVE-2008-6655

Multiple cross-site scripting XSS vulnerabilities in GEDCOMTOMYSQL 2 allow remote attackers to inject arbitrary web script or HTML via the 1 nombranche and 2 nom parameters to php/prenom.php; the 3 nombranche parameter to php/index.php; and the 4 nombranche, 5 nom, and 6 prenom parameters to...

CVE-2008-6646

Cross-site scripting XSS vulnerability in index.php in CoronaMatrix phpAddressBook 2.0 allows remote attackers to inject arbitrary web script or HTML via the username parameter...

CVE-2008-6657: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in index.php in Simple Machines Forum SMF 1.0 before 1.0.15 and 1.1 before 1.1.7 allows remote attackers to hijack the authentication of admins for requests that install packages via the package parameter in an install2 action...

CVE-2008-6655: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in GEDCOMTOMYSQL 2 allow remote attackers to inject arbitrary web script or HTML via the 1 nombranche and 2 nom parameters to php/prenom.php; the 3 nombranche parameter to php/index.php; and the 4 nombranche, 5 nom, and 6 prenom parameters to...

CVE-2009-1258: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the RD-Autos comrdautos component 1.5.7 for Joomla! allows remote attackers to execute arbitrary SQL commands via the makeid parameter in index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-6658: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in Simple Machines Forum SMF 1.0 before 1.0.15 and 1.1 before 1.1.7 allows remote authenticated administrators to install packages from arbitrary directories via a .. dot dot in the package parameter during an install2 action, as demonstrated by a...

Jinzora name Parameter Local File Inclusion

The remote host is running Jinzora, a web-based media streaming and management system written in PHP. The version of Jinzora installed on the remote host fails to filter user-supplied input to the 'name' variable in the 'index.php' script when 'op' is set before using it to include PHP code...

CVE-2008-6659: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in Simple Machines Forum SMF 1.0 before 1.0.15 and 1.1 before 1.1.7 allows remote authenticated users to configure arbitrary local files for execution via directory traversal sequences in the value of the themedir field during a jsoption action,...

CVE-2008-6646: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in CoronaMatrix phpAddressBook 2.0 allows remote attackers to inject arbitrary web script or HTML via the username parameter...

CVE-2008-6631: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in index.php in BlogPHP 2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 user parameter in a sendmessage action and the 2 username parameter when registering a new user, different vectors than CVE-2008-0679...

CVE-2009-1263: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in subcommententry.php in the BookJoomlas combookjoomlas component 0.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the gbid parameter in a comment action to index.php...

CVE-2008-6615

Summary: CVE-2008-6615 describes a SQL injection in Zen Cart 2008 (Zen Software) affecting index.php via the keyword parameter on the advanced_search_result page, allowing remote execution of arbitrary SQL commands. The vulnerability is documented across multiple sources (NVD, CVE lists). The pro...

CVE-2008-6616

CVE-2008-6616 is a cross-site scripting (XSS) vulnerability in Zen Cart 2008, specifically in index.php where the keyword parameter on the advanced_search_result page can inject arbitrary script/HTML. The issue is caused by unsanitized user input that is reflected in the page output. Multiple sou...

Sql injection

SQL injection vulnerability in index.php in Minimal ABlog 0.4 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2008-6611

SQL injection vulnerability in index.php in Minimal ABlog 0.4 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2008-6611

CVE-2008-6611 describes a SQL injection in index.php of Minimal ABlog 0.4, exploitable via the id parameter to execute arbitrary SQL commands. The NVD notes a base score of 7.5 (HIGH) with network attack vector and low complexity, no authentication required, affecting confidentiality, integrity, ...