CVE-2008-6616: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in Zen Software Zen Cart 2008 allows remote attackers to inject arbitrary web script or HTML via the keyword parameter in the advancedsearchresult page. NOTE: the provenance of this information is unknown; the details are obtained solely from...

CVE-2008-6611: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in Minimal ABlog 0.4 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2008-6615: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in Zen Software Zen Cart 2008 allows remote attackers to execute arbitrary SQL commands via the keyword parameter in the advancedsearchresult page. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

osCommerce oscid会话固定漏洞

BUGTRAQ ID: 34348 osCommerce是一套基于GNUGPL授权的开源在线购物电子商务解决方案。 当客户端访问OSCommerce网页时，服务器会发送一个cookie，并将该cookie用作所有之后请求的会话cookie。因此，一旦登录成功，所有之后的请求都会用这个cookie来认证用户，这样攻击者就可以劫持会话执行各种非授权操作。 Harald Ponce de Leon OSCommerce 3.0 Beta Harald Ponce de Leon OSCommerce 2.2 厂商补丁： Harald Ponce de Leon...

CVE-2008-6604: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in PicoFlat CMS 0.5.9 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the pagina parameter, a different vulnerability than CVE-2007-5390...

Code injection

LightNEasy "no database" aka flat version 1.2.2, and possibly SQLite version 1.2.2, allows remote attackers to create arbitrary files via the page parameter to 1 index.php and 2 LightNEasy.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in LightNEasy "no database" aka flat version 1.2.2, and possibly SQLite version 1.2.2, allow remote attackers to inject arbitrary web script or HTML via the page parameter to 1 index.php and 2 LightNEasy.php...

Sql injection

SQL injection vulnerability in LightNEasy/lightneasy.php in LightNEasy SQLite 1.2.2 and earlier allows remote attackers to inject arbitrary PHP code into comments.dat via the dlid parameter to index.php...

CVE-2008-6584

html/index.php in TorrentFlux 2.3 allows remote authenticated users to execute arbitrary code via a URL with a file containing an executable extension in the urlupload parameter, which is downloaded by TorrentFlux and can be accessed via a direct request in a html/downloads/ user directory...

CVE-2008-6591

LightNEasy "no database" aka flat version 1.2.2, and possibly SQLite version 1.2.2, allows remote attackers to create arbitrary files via the page parameter to 1 index.php and 2 LightNEasy.php...

CVE-2008-6593

CVE-2008-6593 describes an SQL injection in LightNEasy SQLite 1.2.2 and earlier affecting lightneasy.php. The vulnerability allows remote attackers to inject arbitrary PHP code into comments.dat via the dlid parameter to index.php, due to insufficient input validation in the affected component. T...

CVE-2008-6596

CVE-2008-6596 affects PHCDownload 1.1, specifically the admin/index.php component. The vulnerability is a SQL injection via the hash parameter, enabling remote attackers to execute arbitrary SQL commands. Documented impact per the CVE is partial confidentiality, integrity, and availability exposu...

CVE-2008-6596: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/index.php in PHCDownload 1.1 allows remote attackers to execute arbitrary SQL commands via the hash parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-6589: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in LightNEasy "no database" aka flat version 1.2.2, and possibly SQLite version 1.2.2, allow remote attackers to inject arbitrary web script or HTML via the page parameter to 1 index.php and 2 LightNEasy.php...

CVE-2008-6597: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in upload/install/index.php in PHCDownload 1.1 allows remote attackers to inject arbitrary web script or HTML via the step parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-6586: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in gui/index.php in µTorrent uTorrent WebUI 0.315 allows remote attackers to 1 hijack the authentication of users for requests that force the download of arbitrary torrent files via the add-url action and 2 hijack the authentication of administrators...

CVE-2008-6584: Improper Control of Generation of Code

html/index.php in TorrentFlux 2.3 allows remote authenticated users to execute arbitrary code via a URL with a file containing an executable extension in the urlupload parameter, which is downloaded by TorrentFlux and can be accessed via a direct request in a html/downloads/ user directory...

CVE-2008-6593: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in LightNEasy/lightneasy.php in LightNEasy SQLite 1.2.2 and earlier allows remote attackers to inject arbitrary PHP code into comments.dat via the dlid parameter to index.php...

Sql injection

SQL injection vulnerability in index.php in Miniweb 2.0 allows remote attackers to execute arbitrary SQL commands via the username parameter in a login action...

CVE-2009-1225

CVE-2009-1225 concerns Turnkey Ebook Store 1.1, where the index.php search action is vulnerable to XSS through the keywords parameter. The root cause is unsanitized input that allows injection of arbitrary HTML/script. Exploitation details or in-wild status are not provided in the documents, and ...