CVE-2008-6646

CVE-2008-6646 affects CoronaMatrix phpAddressBook 2.0, where index.php processes the username parameter. The vulnerability is a cross-site scripting (XSS) flaw caused by inadequate sanitization of user input, enabling remote attackers to inject arbitrary script/HTML in victims’ browsers. Exploita...

CVE-2008-6624

SQL injection vulnerability in getin.php in WEBBDOMAIN Petition 1.02, 2.0, and 3.0 allows remote attackers to execute arbitrary SQL commands via the username parameter...

Sql injection

SQL injection vulnerability in index.php in Miniweb 2.0 allows remote attackers to execute arbitrary SQL commands via the username parameter in a login action...

Authentication flaw

login.php in CelerBB 0.0.2, when magicquotesgpc is disabled, allows remote attackers to bypass authentication and obtain administrative access via special characters in the Username parameter, as demonstrated by an admin' parameter value...

Sql injection

SQL injection vulnerability in login.php in the smNews example script for txtSQL 2.2 Final allows remote attackers to execute arbitrary SQL commands via the username parameter...

CVE-2008-6371

SQL injection vulnerability in login.asp in Ocean12 Membership Manager Pro allows remote attackers to execute arbitrary SQL commands via the username Username parameter...

Sql injection

SQL injection vulnerability in main.asp in Jbook allows remote attackers to execute arbitrary SQL commands via the username user parameter...

CVE-2008-6391

SQL injection vulnerability in main.asp in Jbook allows remote attackers to execute arbitrary SQL commands via the username user parameter...

Sql injection

SQL injection vulnerability in login.asp in Ocean12 Membership Manager Pro allows remote attackers to execute arbitrary SQL commands via the username Username parameter...

CVE-2008-6371

SQL injection vulnerability in login.asp in Ocean12 Membership Manager Pro allows remote attackers to execute arbitrary SQL commands via the username Username parameter...

CVE-2008-6312

SQL injection vulnerability in index.php in ProQuiz 1.0 allows remote attackers to execute arbitrary SQL commands via the username parameter...

Directory traversal

Multiple directory traversal vulnerabilities in LightBlog 9.8, when magicquotesgpc is disabled, allow remote attackers to include and execute arbitrary local files via a .. dot dot in the 1 username parameter to viewmember.php, 2 usernamepost parameter to login.php, and the 3 Lightblogusername...

Cross site scripting

Cross-site scripting XSS vulnerability in the anonymous comments feature in lib-comment.php in glFusion 1.1.0, 1.1.1, and earlier versions allows remote attackers to inject arbitrary web script or HTML via the username parameter to comment.php...

CVE-2009-0409

SQL injection vulnerability in offlineauth.php in Max.Blog 1.0.6 and earlier, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username parameter...

Sql injection

SQL injection vulnerability in offlineauth.php in Max.Blog 1.0.6 and earlier, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username parameter...

CVE-2009-0109

SQL injection vulnerability in index.php in RiotPix 0.61 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: some of these details are obtained from third party information...

CVE-2008-5737

SQL injection vulnerability in index.php in Nodstrum MySQL Calendar 1.1 and 1.2 allows remote attackers to execute arbitrary SQL commands via the username parameter...

Sql injection

SQL injection vulnerability in index.php in Nodstrum MySQL Calendar 1.1 and 1.2 allows remote attackers to execute arbitrary SQL commands via the username parameter...

Sql injection

SQL injection vulnerability in the loginADP function in ajaxp.php in MyioSoft AjaxPortal 3.0 allows remote attackers to execute arbitrary SQL commands via the rsargs parameter, as reachable through the username parameter. NOTE: some of these details are obtained from third party information...

Sql injection

SQL injection vulnerability in the loginADP function in ajaxp.php in MyioSoft EasyBookMarker 4.0 allows remote attackers to execute arbitrary SQL commands via the rsargs parameter, as reachable through the username parameter. NOTE: some of these details are obtained from third party information...