Sql injection

SQL injection vulnerability in the select function in Irokez CMS 0.7.1, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the PATHINFO to the default URI...

CVE-2009-4982

SQL injection vulnerability in the select function in Irokez CMS 0.7.1, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the PATHINFO to the default URI...

CVE-2009-4982: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the select function in Irokez CMS 0.7.1, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the PATHINFO to the default URI...

Sql injection

SQL injection vulnerability in modules/blog/index.php in AneCMS Blog 1.3 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the PATHINFO...

CVE-2010-2436

SQL injection vulnerability in modules/blog/index.php in AneCMS Blog 1.3 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the PATHINFO...

CVE-2010-2436: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in modules/blog/index.php in AneCMS Blog 1.3 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the PATHINFO...

CVE-2010-1515

Multiple cross-site scripting XSS vulnerabilities in index.php in TomatoCMS 2.0.6 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 keyword or 2 article-id parameter in conjunction with a /admin/news/article/list PATHINFO; the 3 keyword parameter in conjunction...

CVE-2010-2281

Multiple cross-site scripting XSS vulnerabilities in index.php in TomatoCMS 2.0.6 allow remote attackers to inject arbitrary web script or HTML via the 1 keyword or 2 bannerid parameter in conjunction with a /admin/ad/banner/list PATHINFO; and allow remote authenticated users, with certain...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in index.php in TomatoCMS 2.0.6 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 keyword or 2 article-id parameter in conjunction with a /admin/news/article/list PATHINFO; the 3 keyword parameter in conjunction...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in index.php in TomatoCMS 2.0.6 allow remote attackers to inject arbitrary web script or HTML via the 1 keyword or 2 bannerid parameter in conjunction with a /admin/ad/banner/list PATHINFO; and allow remote authenticated users, with certain...

CVE-2010-1515

Multiple cross-site scripting XSS vulnerabilities in index.php in TomatoCMS 2.0.6 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 keyword or 2 article-id parameter in conjunction with a /admin/news/article/list PATHINFO; the 3 keyword parameter in conjunction...

CVE-2010-2260

CVE-2010-2260 affects Gambit Design Bandwidth Meter (versions 0.72 and possibly 1.2). The vulnerability is listed as multiple cross-site scripting (XSS) flaws that allow remote attackers to inject arbitrary web script or HTML via PATH_INFO to admin/view_by_name.php or admin/view_by_ip.php. The av...

CVE-2010-2260

Multiple cross-site scripting XSS vulnerabilities in Gambit Design Bandwidth Meter, 0.72 and possibly 1.2, allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to 1 viewbyname.php or 2 viewbyip.php in admin/. NOTE: some sources report that the affected product is ShaPlus...

CVE-2010-2260: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Gambit Design Bandwidth Meter, 0.72 and possibly 1.2, allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to 1 viewbyname.php or 2 viewbyip.php in admin/. NOTE: some sources report that the affected product is ShaPlus...

Sql injection

SQL injection vulnerability in index.php in TomatoCMS before 2.0.5 allows remote attackers to execute arbitrary SQL commands via the q parameter in conjunction with a /news/search PATHINFO...

CVE-2010-1994

SQL injection vulnerability in index.php in TomatoCMS before 2.0.5 allows remote attackers to execute arbitrary SQL commands via the q parameter in conjunction with a /news/search PATHINFO...

CVE-2010-1994

TomatoCMS is affected by a SQL injection in the /news/search handler. The vulnerability is triggered via the q parameter (e.g., q=) and creates injectable SQL in conjunction with the PATH_INFO /news/search. Affects TomatoCMS prior to 2.0.5; 2.0.5 fixes the issue, with the vulnerability reappearin...

CVE-2009-4861

Cross-site scripting XSS vulnerability in shownews.php in SupportPRO SupportDesk 3.0 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO...

Cross site scripting

Cross-site scripting XSS vulnerability in shownews.php in SupportPRO SupportDesk 3.0 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO...

CVE-2009-4861

CVE-2009-4861 : A cross-site scripting (XSS) vulnerability in SupportPRO SupportDesk 3.0’s shownews.php allows injecting arbitrary script/HTML via PATH_INFO. Affected component is the shownews.php handling in SupportDesk 3.0; root cause is unvalidated PATH_INFO input leading to script injection. ...