CVE-2020-37005: Improper Neutralization of Special Elements used in an SQL Command

TimeClock Software 1.01 contains an authenticated time-based SQL injection vulnerability that allows attackers to enumerate valid usernames by manipulating the 'notes' parameter. Attackers can inject conditional time delays in the addentry.php endpoint to determine user existence by measuring...

Cross site scripting

Cross-site scripting XSS vulnerability in saveentry.php in realGuestbook 5.01 allows remote attackers to inject arbitrary web script or HTML via the homepage parameter, as reachable through addentry.php. NOTE: the original report stated that the vulnerability was in addentry.php, which does not...

CVE-2007-1625

CVE-2007-1625 describes a cross-site scripting (XSS) vulnerability in realGuestbook 5.01. The flaw resides in the save_entry.php routine, where the homepage parameter can be used by remote attackers to inject arbitrary script or HTML. The vulnerability is reachable via add_entry.php, though the o...

CVE-2007-1624: Undefined Security Weakness

Multiple SQL injection vulnerabilities in realGuestbook 5.01 allow remote attackers to execute arbitrary SQL commands via the 1 name, 2 email, 3 homepage, and 4 text parameters to saveentry.php, as reachable through addentry.php; and possibly other unspecified parameters and files. NOTE: the...

CVE-2007-1625: Undefined Security Weakness

Cross-site scripting XSS vulnerability in saveentry.php in realGuestbook 5.01 allows remote attackers to inject arbitrary web script or HTML via the homepage parameter, as reachable through addentry.php. NOTE: the original report stated that the vulnerability was in addentry.php, which does not...