Cross site scripting

Cross-site scripting XSS vulnerability in index.php in the beamospetition combeamospetition 1.0.12 component for Joomla! allows remote attackers to inject arbitrary web script or HTML via the pet parameter in a sign action...

CVE-2009-0378

Cross-site scripting XSS vulnerability in index.php in the beamospetition combeamospetition 1.0.12 component for Joomla! allows remote attackers to inject arbitrary web script or HTML via the pet parameter in a sign action...

CVE-2009-0380: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the Sigsiu Online Business Index 2 SOBI2, comsobi2 RC 2.8.2 component for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the bid parameter in a showbiz action to index.php, a different vector than CVE-2008-0607. NOTE: CVE disputes th...

CVE-2009-0381: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the BazaarBuilder Ecommerce Shopping Cart comprod 5.0 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the cid parameter in a products action to index.php...

CVE-2008-6019: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in EACOMM DO-CMS 3.0 allows remote attackers to execute arbitrary SQL commands via the p parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2009-0378: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in the beamospetition combeamospetition 1.0.12 component for Joomla! allows remote attackers to inject arbitrary web script or HTML via the pet parameter in a sign action...

CVE-2009-0379: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the Prince Clan Chess Club compcchess component for Joomla! allows remote attackers to execute arbitrary SQL commands via the gameid parameter in a showgame action to index.php, a different vector than CVE-2008-0761...

CVE-2008-6018: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in MyPHPSite, when magicquotesgpc is disabled, allows remote attackers to read arbitrary files via a .. dot dot in the mod parameter...

Directory traversal

Multiple directory traversal vulnerabilities in SG Real Estate Portal 2.0 allow remote attackers to read arbitrary files via a .. dot dot in the 1 mod, 2 page, or 3 lang parameter to index.php; or the 4 action or 5 folder parameter in a security request to admin/index.php...

CVE-2008-6011

The vulnerability CVE-2008-6011 affects SG Real Estate Portal 2.0, specifically the index.php page where the page_id parameter is used in SQL queries. The underlying root cause is an SQL injection that allows remote attackers to execute arbitrary SQL commands. The vulnerability is categorized wit...

CVE-2008-6012: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in Pritlog 0.4 and earlier, when magicquotesgpc is disabled, allows remote attackers to read arbitrary files via a .. dot dot in the filename parameter in a viewEntry action...

CVE-2009-0373: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the ElearningForce Flash Magazine Deluxe comflashmagazinedeluxe component for Joomla! allows remote attackers to execute arbitrary SQL commands via the magid parameter in a magazine action to index.php...

CVE-2008-6011: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in SG Real Estate Portal 2.0 allows remote attackers to execute arbitrary SQL commands via the pageid parameter...

CVE-2009-0372: Improper Input Validation

Unrestricted file upload vulnerability in index.php in Miltenovik Manojlo MemHT Portal 4.0.1 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension and an image content type via a users editProfile action, then accessing this file...

CVE-2009-0330

CVE-2009-0330 affects Simple Content Management System (SCMS) 1. The vulnerability is a directory traversal in index.php via the p parameter, enabling remote attackers to include and execute arbitrary local files. Exploit details are not provided in the sources; impacts and vendor/patch specifics...

CVE-2009-0325: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in entries/index.php in Ninja Blog 4.8, when magicquotesgpc is disabled, allows remote attackers to read arbitrary files via a .. dot dot in the cat parameter...

CVE-2009-0330: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in Simple Content Management System SCMS 1 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the p parameter...

CVE-2009-0329: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the PcCookBook compccookbook component for Joomla! allows remote attackers to execute arbitrary SQL commands via the recipeid parameter in a viewrecipe action to index.php, a different vector than CVE-2008-0844...

CVE-2008-6001

index.php in ADN Forum 1.0b and earlier allows remote attackers to bypass authentication and gain sysop access via a fpusuario cookie composed of an initial sysop: string, an arbitrary password field, and a final :sysop:0 string...

CVE-2008-6001: Undefined Security Weakness

index.php in ADN Forum 1.0b and earlier allows remote attackers to bypass authentication and gain sysop access via a fpusuario cookie composed of an initial sysop: string, an arbitrary password field, and a final :sysop:0 string...