EUVD-2006-1692

Malware in sbrugna...

EUVD-2006-1693

Malware in sbrugna...

EUVD-2006-1691

Malware in sbrugna...

[eVuln] MWNewsletter SQL Injection and XSS Vulnerabilities

New eVuln Advisory: MWNewsletter SQL Injection and XSS Vulnerabilities http://evuln.com/vulns/123/summary.html --------------------Summary---------------- eVuln ID: EV0123 CVE: CVE-2006-1690 CVE-2006-1691 CVE-2006-1692 Vendor: Manic Web Software: MWNewsletter Sowtware's Web Site:...

Sql injection

Multiple SQL injection vulnerabilities in MWNewsletter 1.0.0b allow remote attackers to execute arbitrary SQL commands via the 1 useremail parameter to a unsubscribe.php or b subscribe.php; or the 2 username parameter to subscribe.php. NOTE: the provenance of this information is unknown; the...

Sql injection

SQL injection vulnerability in MWNewsletter 1.0.0b allows remote attackers to execute arbitrary SQL commands via the username parameter to unsubscribe.php...

CVE-2006-1690

Cross-site scripting XSS vulnerability in subscribe.php in MWNewsletter 1.0.0b allows remote attackers to inject arbitrary web script or HTML via the username parameter...

CVE-2006-1691

SQL injection vulnerability in MWNewsletter 1.0.0b allows remote attackers to execute arbitrary SQL commands via the username parameter to unsubscribe.php...

CVE-2006-1692

Multiple SQL injection vulnerabilities in MWNewsletter 1.0.0b allow remote attackers to execute arbitrary SQL commands via the 1 useremail parameter to a unsubscribe.php or b subscribe.php; or the 2 username parameter to subscribe.php. NOTE: the provenance of this information is unknown; the...

CVE-2006-1690

Cross-site scripting XSS vulnerability in subscribe.php in MWNewsletter 1.0.0b allows remote attackers to inject arbitrary web script or HTML via the username parameter...

CVE-2006-1691

CVE-2006-1691 : A SQL injection vulnerability in MWNewsletter 1.0.0b affects the unsubscribe.php script via the user_name parameter. Multiple connected sources confirm the vulnerability arises from inadequate input sanitization, allowing remote attackers to inject arbitrary SQL. Impact is describ...

CVE-2006-1692

CVE-2006-1692 concerns MWNewsletter 1.0.0b, where multiple SQL injection flaws are exposed via input parameters. Specifically, unsanitized user_email (in unsubscribe.php and subscribe.php) and user_name (in subscribe.php) allow remote attackers to inject arbitrary SQL commands, enabling potential...

CVE-2006-1690

MWNewsletter 1.0.0b is affected by an XSS in subscribe.php via the user_name parameter (CVE-2006-1690). The eVuln entry also documents a SQL Injection vulnerability in unsubscribe.php affecting the same MWNewsletter version, with PoC/Exploit available and no patch listed. CVSS from NVD: 6.8 (Medi...

CVE-2006-1691

SQL injection vulnerability in MWNewsletter 1.0.0b allows remote attackers to execute arbitrary SQL commands via the username parameter to unsubscribe.php...

CVE-2006-1692

Multiple SQL injection vulnerabilities in MWNewsletter 1.0.0b allow remote attackers to execute arbitrary SQL commands via the 1 useremail parameter to a unsubscribe.php or b subscribe.php; or the 2 username parameter to subscribe.php. NOTE: the provenance of this information is unknown; the...

CVE-2006-1690: Undefined Security Weakness

Cross-site scripting XSS vulnerability in subscribe.php in MWNewsletter 1.0.0b allows remote attackers to inject arbitrary web script or HTML via the username parameter...

CVE-2006-1691: Undefined Security Weakness

SQL injection vulnerability in MWNewsletter 1.0.0b allows remote attackers to execute arbitrary SQL commands via the username parameter to unsubscribe.php...

CVE-2006-1692: Undefined Security Weakness

Multiple SQL injection vulnerabilities in MWNewsletter 1.0.0b allow remote attackers to execute arbitrary SQL commands via the 1 useremail parameter to a unsubscribe.php or b subscribe.php; or the 2 username parameter to subscribe.php. NOTE: the provenance of this information is unknown; the...