CVE-2008-5628

CVE-2008-5628 corresponds to an SQL injection in index.php of CMS little 0.0.1, enabling remote attackers to execute arbitrary SQL commands via the term parameter. Affected component: index.php in CMS little 0.0.1. Root cause: unsafeguarded SQL construction through user-supplied term parameter. R...

CVE-2008-5629

CVE-2008-5629 describes an SQL injection in the Turnkey Arcade Script: vulnerable component is index.php, via the id parameter in a play action. The underlying flaw allows remote attackers to inject arbitrary SQL and potentially affect data, due to the input being unsafely concatenated into queri...

CVE-2008-5630: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in merchants/index.php in Post Affiliate Pro 3 and 3.1.4 allows remote attackers to execute arbitrary SQL commands via the umprofstatus parameter...

CVE-2008-5629: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in Turnkey Arcade Script allows remote attackers to execute arbitrary SQL commands via the id parameter in a play action...

CVE-2008-5639: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in TxtBlog 1.0 Alpha allows remote attackers to read arbitrary files via a .. dot dot in the m parameter...

CVE-2008-5628: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in CMS little 0.0.1 allows remote attackers to execute arbitrary SQL commands via the term parameter...

CVE-2008-5604

The CVE-2008-5604 issue affects My Simple Forum 3.0 and 4.1, where a directory traversal flaw in index.php allows remote attackers to include and execute local files via a .. in the action parameter when magic_quotes_gpc is disabled. This is a file-path handling vulnerability that can compromise ...

CVE-2008-5593: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in index.php in Mini CMS 1.0.1 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the 1 page and 2 admin parameters...

CVE-2008-5607: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the JMovies aka JM or comjmovies component 1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php...

CVE-2008-5604: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in My Simple Forum 3.0 and 4.1, when magicquotesgpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the action parameter...

CVE-2008-5598: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in PHPmyGallery 1.51 gold allows remote attackers to list arbitrary directories via a .. dot dot in the group parameter...

CVE-2008-5594: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in index.php in Mini Blog 1.0.1 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the 1 page and 2 admin parameters...

CVE-2008-5566

Cross-site scripting XSS vulnerability in index.php in Triangle Solutions PHP Multiple Newsletters 2.7 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO...

CVE-2008-5570

Directory traversal vulnerability in index.php in PHP Multiple Newsletters 2.7, when magicquotesgpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the lang parameter...

CVE-2008-5584

Multiple cross-site scripting XSS vulnerabilities in ProjectPier 0.8 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 a message, 2 a milestone, or 3 a display name in a profile, or the 4 a or 5 c parameter to index.php...

Sql injection

Multiple SQL injection vulnerabilities in index.php in sCssBoard 1.0, 1.1, 1.11, and 1.12 allow remote attackers to execute arbitrary SQL commands via 1 the f parameter in a showforum action, 2 the u parameter in a profile action, 3 the viewcat parameter, or 4 a combination of scbuid and scbident...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in PHPepperShop 1.4 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to 1 index.php or 2 shop/kontakt.php, or 3 shopkundenmgmt.php or 4 SHOPKONFIGURATION.php in shop/Admin/...

CVE-2008-5583

The CVE-2008-5583 entry describes a cross-site request forgery in ProjectPier 0.8 and earlier, where an attacker can cause actions as an administrator through the index.php query string (e.g., delete project). Affected software: ProjectPier 0.8 and earlier. Root cause: CSRF in index.php allowing ...

CVE-2008-5578

CVE-2008-5578 describes multiple SQL injection vulnerabilities in the sCssBoard product (versions 1.0, 1.1, 1.11, 1.12) affecting index.php. Attack vectors include (1) f parameter in showforum, (2) u parameter in profile, (3) viewcat parameter, and (4) combinations of scb_uid/scb_ident cookie val...

CVE-2008-5566: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in Triangle Solutions PHP Multiple Newsletters 2.7 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO...