CVE-2008-2814

Cross-site scripting XSS vulnerability in WallCity-Server Shoutcast Admin Panel 2.0 allows remote attackers to inject arbitrary web script or HTML via the username parameter to the login interface. NOTE: the provenance of this information is unknown; the details are obtained solely from third par...

Sql injection

Multiple SQL injection vulnerabilities in Acidcat CMS 3.4.1 allow remote attackers to execute arbitrary SQL commands via the 1 cID parameter to default.asp and the 2 username parameter to mainlogin2.asp...

Sql injection

Multiple SQL injection vulnerabilities in KnowledgeQuest 2.6, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 kqid parameter to a articletext.php and b articletextonly.php and the 2 username parameter to c logincheck.php...

viewuser.action has an XSS problem around username

Steps to reproduce: create a user with username: foo"alert'hello';span class="ff you should get an alert when you are redirected to viewuser.action to view the user you just created...

Cross site scripting

Cross-site scripting XSS vulnerability in AuthentiX 6.3b1 Trial allows remote attackers to inject arbitrary web script or HTML via the username parameter to aspAdmin/deleteUser.asp, a different vector than CVE-2008-1174. NOTE: the provenance of this information is unknown; the details are obtaine...

CVE-2008-1174

Cross-site scripting XSS vulnerability in editUser.asp in AuthentiX 6.3b1 Trial allows remote attackers to inject arbitrary web script or HTML via the username parameter...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Dokeos 1.8.4 allow remote attackers to inject arbitrary web script or HTML via the 1 username parameter to inscription.php, 2 courseCode parameter to main/calendar/myagenda.php, 3 category parameter to main/admin/coursecategory.php, 4 message...

CVE-2008-0840

Directory traversal vulnerability in viewmember.php in Public Warehouse LightBlog 9.6 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the username parameter...

Directory traversal

Directory traversal vulnerability in viewmember.php in Public Warehouse LightBlog 9.6 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the username parameter...

CVE-2008-0783

Multiple cross-site scripting XSS vulnerabilities in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k allow remote attackers to inject arbitrary web script or HTML via 1 the viewtype parameter to graph.php; 2 the filter parameter to graphview.php; 3 the action parameter to the drawnavigationtext...

Sql injection

SQL injection vulnerability in users.php in Mihalism Multi Host allows remote attackers to execute arbitrary SQL commands via the username parameter in a lostpasswordgo action...

Firebird关系数据库Username参数远程栈溢出漏洞

BUGTRAQ ID: 27467 Firebird是一款提供多个ANSI SQL-92功能的关系型数据库，可运行在Linux、Windows和各种Unix平台下。 Firebird在处理畸形的用户请求时存在漏洞，远程攻击者可能利用此漏洞控制服务器。 如果远程攻击者向Firebird服务器提交了超长用户名的话，就可能触发栈溢出，导致执行任意指令。 Firebird Firebird 2.1 Beta 1 Firebird Firebird 2.1 Alpha 1 Firebird Firebird 2.0.3 Firebird Firebird 2.0.2 Firebird Firebi...

CVE-2008-0371

Multiple SQL injection vulnerabilities in aliTalk 1.9.1.1, when magicquotesgpc is disabled, allow remote authenticated users to execute arbitrary SQL commands via 1 the mohit parameter to a inc/receivertwo.php; and allow remote attackers to execute arbitrary SQL commands via 2 the id parameter to...

CVE-2008-0254

CVE-2008-0254 is a SQL injection vulnerability in TutorialCMS (Photoshop Tutorials) 1.02, affecting activate.php. When magic_quotes_gpc is disabled, remote attackers can inject SQL via the userName parameter. Documented impact is partial confidentiality/integrity/availability with CVSS 2.0 base s...

Sql injection

SQL injection vulnerability in index.php in SmallNuke 2.0.4 and earlier, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via 1 the useremail parameter and possibly 2 username parameter in a Members action...

Sql injection

SQL injection vulnerability in loginform.asp in Instant Softwares Dating Site allows remote attackers to execute arbitrary SQL commands via the Username parameter, a different vulnerability than CVE-2007-6671. NOTE: the provenance of this information is unknown; the details are obtained solely fr...

CVE-2008-0130

SQL injection vulnerability in loginform.asp in Instant Softwares Dating Site allows remote attackers to execute arbitrary SQL commands via the Username parameter, a different vulnerability than CVE-2007-6671. NOTE: the provenance of this information is unknown; the details are obtained solely fr...

IBM Rational ClearQuest Username Parameter SQL Injection Vulnerability

IBM Rational ClearQuest is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in...

CVE-2007-6486

Multiple cross-site scripting XSS vulnerabilities in shout.php aka the shoutbox in LineShout 1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 username nickname or 2 message parameter. NOTE: some of these details are obtained from third party information...

Sql injection

SQL injection vulnerability in index.php in phpRPG 0.8, when magicqutoesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: some of these details are obtained from third party information...