CVE-2008-6205: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in seeurl.php in Xavier Flahaut URLStreet 1.0 allows remote attackers to inject arbitrary web script or HTML via the 1 language, 2 order, and 3 filter parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third...

EJBQL injection via 'order' parameter

The getRenderedEjbql method in the org.jboss.seam.framework.Query class in JBoss Seam 2.x before 2.0.0.CR3 allows remote attackers to inject and execute arbitrary EJBQL commands via the order parameter...

EJBQL injection via 'order' parameter

The getRenderedEjbql method in the org.jboss.seam.framework.Query class in JBoss Seam 2.x before 2.0.0.CR3 allows remote attackers to inject and execute arbitrary EJBQL commands via the order parameter...

EJBQL injection via 'order' parameter

The getRenderedEjbql method in the org.jboss.seam.framework.Query class in JBoss Seam 2.x before 2.0.0.CR3 allows remote attackers to inject and execute arbitrary EJBQL commands via the order parameter...

Design/Logic Flaw

The getRenderedEjbql method in the org.jboss.seam.framework.Query class in JBoss Seam 2.x before 2.0.0.CR3 allows remote attackers to inject and execute arbitrary EJBQL commands via the order parameter...

CVE-2007-6433

The getRenderedEjbql method in the org.jboss.seam.framework.Query class in JBoss Seam 2.x before 2.0.0.CR3 allows remote attackers to inject and execute arbitrary EJBQL commands via the order parameter...

CVE-2007-6433: Improper Input Validation

The getRenderedEjbql method in the org.jboss.seam.framework.Query class in JBoss Seam 2.x before 2.0.0.CR3 allows remote attackers to inject and execute arbitrary EJBQL commands via the order parameter...

Joomla! com_content Component 'order' Parameter XSS

The version of Joomla! running on the remote host is affected by a cross-site scripting XSS vulnerability in comcontent/content.php due to improper sanitization of user-supplied input to the 'order' parameter before using it to generate dynamic HTML content. An unauthenticated, remote attacker ca...

LinPHA < 1.3.2 SQL Injection Vulnerability

Binary data 4150.prm...

CVE-2007-4053: Undefined Security Weakness

SQL injection vulnerability in include/imgview.class.php in LinPHA 1.3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the order parameter to newimages.php...

CVE-2007-3584: Undefined Security Weakness

SQL injection vulnerability in viewforum.php in PNphpBB2 1.2i and earlier for Postnuke allows remote attackers to execute arbitrary SQL commands via the order parameter...

CVE-2007-2962

Cross-site scripting XSS vulnerability in search.php in Particle Gallery 1.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the order parameter...

CVE-2007-2962: Undefined Security Weakness

Cross-site scripting XSS vulnerability in search.php in Particle Gallery 1.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the order parameter...

Directory traversal

Directory traversal vulnerability in checkvote.php in Weekly Drawing Contest 0.0.1 allows remote attackers to read arbitrary files via a .. dot dot in the order parameter. NOTE: another researcher disputes this vulnerability, noting that the order variable is not used in any context that allows...

PT-2007-2983 · Unknown · Weekly Drawing Contest

Name of the Vulnerable Software and Affected Versions: Weekly Drawing Contest version 0.0.1 Description: The issue allows remote attackers to potentially read arbitrary files via a .. dot dot in the order parameter in the check vote.php file. However, it is noted that another researcher disputes...

CVE-2007-1602: Undefined Security Weakness

SQL injection vulnerability in checkvote.php in Weekly Drawing Contest 0.0.1 allows remote attackers to execute arbitrary SQL commands via the order parameter...

CVE-2007-1601: Undefined Security Weakness

Directory traversal vulnerability in checkvote.php in Weekly Drawing Contest 0.0.1 allows remote attackers to read arbitrary files via a .. dot dot in the order parameter. NOTE: another researcher disputes this vulnerability, noting that the order variable is not used in any context that allows...

CVE-2006-6972: Undefined Security Weakness

SQL injection in torrents.php in BtitTracker 1.3.2 and earlier allows remote attackers to execute arbitrary SQL commands via the 1 by and 2 order parameters. NOTE: it is not clear whether this issue is exploitable...

CVE-2006-4871

SQL injection vulnerability in searchrun.asp in Keyvan1 aka Keyvan Janghorbani EShoppingPro 1.0 allows remote attackers to execute arbitrary SQL commands via the order parameter...

CVE-2006-4871: Undefined Security Weakness

SQL injection vulnerability in searchrun.asp in Keyvan1 aka Keyvan Janghorbani EShoppingPro 1.0 allows remote attackers to execute arbitrary SQL commands via the order parameter...