CVE-2007-1237: Exposure of Sensitive Information to an Unauthorized Actor

sitex allows remote attackers to obtain potentially sensitive information via a ' quote value for certain parameters, as demonstrated by parameters used in forum and search, which forces a SQL error...

Cross site scripting

Cross-site scripting XSS vulnerability in LoveCMS 1.4 allows remote attackers to inject arbitrary web script or HTML via the id parameter to the top-level URI, possibly related to a SQL error...

CVE-2007-1151

Cross-site scripting XSS vulnerability in LoveCMS 1.4 allows remote attackers to inject arbitrary web script or HTML via the id parameter to the top-level URI, possibly related to a SQL error...

CVE-2007-1151

Cross-site scripting XSS vulnerability in LoveCMS 1.4 allows remote attackers to inject arbitrary web script or HTML via the id parameter to the top-level URI, possibly related to a SQL error...

CVE-2007-1151: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in LoveCMS 1.4 allows remote attackers to inject arbitrary web script or HTML via the id parameter to the top-level URI, possibly related to a SQL error...

DevTrack Web Service UserName Field SQL Injection

The remote host is running DevTrack, a defect and project tracking tool. The DevTrack Web Services component installed on the remote host contains an ASP script that fails to sanitize user-supplied input to the 'UserName' parameter before using it in a database query. An unauthenticated, remote...

Sql injection

index.php in Nwom topsites 3.0 allows remote attackers to obtain potentially sensitive information via a ' quote character in the o parameter, which forces a SQL error...

CVE-2007-0250

index.php in Nwom topsites 3.0 allows remote attackers to obtain potentially sensitive information via a ' quote character in the o parameter, which forces a SQL error...

CVE-2007-0250

index.php in Nwom topsites 3.0 allows remote attackers to obtain potentially sensitive information via a ' quote character in the o parameter, which forces a SQL error...

CVE-2007-0250

CVE-2007-0250 affects Nwom topsites 3.0. The vulnerability is in index.php where a single quote in the o parameter can trigger a SQL error, potentially exposing sensitive information. Concrete impact is information disclosure (partial confidentiality). No remediation or patch details are provided...

CVE-2007-0250: Undefined Security Weakness

index.php in Nwom topsites 3.0 allows remote attackers to obtain potentially sensitive information via a ' quote character in the o parameter, which forces a SQL error...

CVE-2006-6924

bitweaver 1.3.1 and earlier allows remote attackers to obtain sensitive information via a sortmode=-98 query string to 1 blogs/listblogs.php, 2 fisheye/index.php, 3 wiki/orphanpages.php, or 4 wiki/listpages.php, which forces a SQL error. NOTE: the fisheye/listgalleries.php vector is already cover...

CVE-2006-6924

CVE-2006-6924 affects Bitweaver 1.3.1 and earlier, where a remote attacker can trigger a SQL error and potentially expose sensitive information by sending sort_mode=-98 to one of: blogs/list_blogs.php, fisheye/index.php, wiki/orphan_pages.php, or wiki/list_pages.php. The issue is described as a v...

CVE-2006-6924: Undefined Security Weakness

bitweaver 1.3.1 and earlier allows remote attackers to obtain sensitive information via a sortmode=-98 query string to 1 blogs/listblogs.php, 2 fisheye/index.php, 3 wiki/orphanpages.php, or 4 wiki/listpages.php, which forces a SQL error. NOTE: the fisheye/listgalleries.php vector is already cover...

CVE-2006-6282

members.php in Vikingboard 0.1.2 allows remote attackers to trigger a forced SQL error via an invalid s parameter, a different vector than CVE-2006-4709. NOTE: might only be an exposure if displayerrors is enabled, but due to lack of details, even this is not clear...

CVE-2006-6282

Vulnerability: Vikingboard 0.1b is affected by CVE-2006-6282 (and related CVE-2006-4709) due to a SQL injection in topic.php via the s parameter. The issue can allow remote attackers to trigger a forced SQL error or execute arbitrary SQL commands. Affected component/file: topic.php in Vikingboard...

CVE-2006-6282

members.php in Vikingboard 0.1.2 allows remote attackers to trigger a forced SQL error via an invalid s parameter, a different vector than CVE-2006-4709. NOTE: might only be an exposure if displayerrors is enabled, but due to lack of details, even this is not clear...

CVE-2006-6282: Undefined Security Weakness

members.php in Vikingboard 0.1.2 allows remote attackers to trigger a forced SQL error via an invalid s parameter, a different vector than CVE-2006-4709. NOTE: might only be an exposure if displayerrors is enabled, but due to lack of details, even this is not clear...

vikiboard012.txt

vendor site:http://vikingboard.com/ product:Vikingboard 0.1.2 bug:local file include & multiples permanent xss risk:medium error sql : /members.php?s=-80 xss permanent : - in private message , an attacker can send a pm to an administrator with some javascript into the subject field an get his...

CVE-2006-4043

index.php in myWebland myBloggie 2.1.4 and earlier allows remote attackers to obtain sensitive information via a query that only specifies the viewdate mode, which reveals the table prefix in a SQL error message...