CVE-2009-4721

CVE-2009-4721 affects Andrews-Web (A-W) BannerAd 1.0, with multiple SQL injection vulnerabilities in Admin/index.asp that allow remote attackers to execute arbitrary SQL commands via the (1) User and (2) Password parameters. The root cause is unsafely constructed SQL queries in that page, enablin...

CVE-2009-4721: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Admin/index.asp in Andrews-Web A-W BannerAd 1.0 allow remote attackers to execute arbitrary SQL commands via the 1 User and 2 Password parameters. NOTE: some of these details are obtained from third party information...

CVE-2010-0952: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in OneCMS 2.5, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the user parameter in an elite action...

CVE-2009-3543: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in phenotype/admin/login.php in Phenotype CMS before 2.9 allows remote attackers to execute arbitrary SQL commands via the user parameter aka the login name...

CVE-2009-3255: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in RASH Quote Management System RQMS 1.2.2 and earlier, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the user parameter in an admin action to the default URI...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Anantasoft Gazelle CMS 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 user parameter to user.php or 2 lookup parameter to search.php...

CVE-2009-3171

Multiple cross-site scripting XSS vulnerabilities in Anantasoft Gazelle CMS 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 user parameter to user.php or 2 lookup parameter to search.php...

CVE-2009-3171

Multiple cross-site scripting XSS vulnerabilities in Anantasoft Gazelle CMS 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 user parameter to user.php or 2 lookup parameter to search.php...

Sql injection

Multiple SQL injection vulnerabilities in OneCMS 2.4, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the 1 username parameter $usernameb variable to alogin.php or 2 user parameter to staff.php...

CVE-2009-3180: Undefined Security Weakness

Anantasoft Gazelle CMS 1.0 allows remote attackers to conduct a password reset for other users via a modified user parameter to renew.php...

CVE-2008-7208: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in OneCMS 2.4, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the 1 username parameter $usernameb variable to alogin.php or 2 user parameter to staff.php...

CVE-2008-6917: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin.php in Exocrew ExoPHPDesk 1.2 Final allows remote attackers to execute arbitrary SQL commands via the username user parameter...

CVE-2009-2573: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in MiniTwitter 0.2 beta, when magicquotesgpc is disabled, allow remote authenticated users to execute arbitrary SQL commands via the 1 user parameter to a index.php and b rss.php...

CVE-2009-1816

SQL injection vulnerability in admin.php in My Game Script 2.0 allows remote attackers to execute arbitrary SQL commands via the user parameter aka the username field. NOTE: some of these details are obtained from third party information...

CVE-2009-1816: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin.php in My Game Script 2.0 allows remote attackers to execute arbitrary SQL commands via the user parameter aka the username field. NOTE: some of these details are obtained from third party information...

LimeSurvey sUser Parameter SQL Injection

The remote host is running LimeSurvey, an open source tool for online surveys. The version of LimeSurvey installed on the remote host fails to sanitize user-supplied input passed to the 'sUser' argument in the 'checkUser' method of the 'LsrcHelper' class in 'admin/remotecontrol/lsrc.helper.php'...

CVE-2008-6631

Multiple cross-site scripting XSS vulnerabilities in index.php in BlogPHP 2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 user parameter in a sendmessage action and the 2 username parameter when registering a new user, different vectors than CVE-2008-0679...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in index.php in BlogPHP 2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 user parameter in a sendmessage action and the 2 username parameter when registering a new user, different vectors than CVE-2008-0679...

CVE-2008-6631: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in index.php in BlogPHP 2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 user parameter in a sendmessage action and the 2 username parameter when registering a new user, different vectors than CVE-2008-0679...

Sql injection

Multiple SQL injection vulnerabilities in nForum 1.5 allow remote attackers to execute arbitrary SQL commands via the 1 id parameter to showtheme.php and the 2 user parameter to userinfo.php...