CVE-2008-6270: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/index.php in Dragan Mitic Apoll 0.7 beta and 0.7.5 allows remote attackers to execute arbitrary SQL command via the user parameter...

CVE-2008-6272: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/index.php in Dragan Mitic Apoll 0.7 beta and 0.7.5 allows remote attackers to execute arbitrary SQL command via the pass parameter...

CVE-2009-0707

SQL injection vulnerability in admin/index.php in PowerClan 1.14a allows remote attackers to execute arbitrary SQL commands via the loginemail parameter aka login field. NOTE: some of these details are obtained from third party information...

CVE-2009-0707

CVE-2009-0707 is a SQL injection vulnerability in PowerClan 1.14a, specifically in admin/index.php where the loginemail parameter (login field) can be used to execute arbitrary SQL commands. The available connected documents confirm the affected component (admin/index.php), the software/version (...

CVE-2009-0707: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/index.php in PowerClan 1.14a allows remote attackers to execute arbitrary SQL commands via the loginemail parameter aka login field. NOTE: some of these details are obtained from third party information...

CVE-2008-6241: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in admin/usercheck.php in FlexPHPSite 0.0.1 and 0.0.7, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via 1 the checkuser parameter aka username field, or 2 the checkpass parameter aka password field, to...

CVE-2009-0648: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the manageusers handler in admin/index.php in Falt4 CMS aka Falt4 Extreme RC4 allow remote attackers to hijack the authentication of administrators for requests that change passwords via the 1 edit and 2 editnow actions...

CVE-2009-0597

CVE-2009-0597 describes an SQL injection in the w3b>cms (aka w3blabor CMS) admin/index.php before version 3.4.0, exploitable when magic_quotes_gpc is disabled. A remote attacker can inject SQL via the benutzername (Username) field in the login action, potentially executing arbitrary SQL comman...

CVE-2009-0597: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/index.php in w3bcms aka w3blabor CMS before 3.4.0, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the benutzername parameter aka Username field in a login action...

Sql injection

SQL injection vulnerability in A4Desk PHP Event Calendar allows remote attackers to execute arbitrary SQL commands via the eventid parameter to admin/index.php...

CVE-2008-6104

Summary of CVE-2008-6104 (A4Desk Event Calendar SQLi) Affects: A4Desk PHP Event Calendar.Vulnerability: SQL injection via the eventid parameter to admin/index.php, caused by insufficient input sanitization.Impact: Remote attackers could execute arbitrary SQL commands (partial confidentiality/ int...

CVE-2008-6104: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in A4Desk PHP Event Calendar allows remote attackers to execute arbitrary SQL commands via the eventid parameter to admin/index.php...

Directory traversal

Multiple directory traversal vulnerabilities in SG Real Estate Portal 2.0 allow remote attackers to read arbitrary files via a .. dot dot in the 1 mod, 2 page, or 3 lang parameter to index.php; or the 4 action or 5 folder parameter in a security request to admin/index.php...

CVE-2008-5967: Improper Authentication

admin/index.php in PHP iCalendar 2.3.4, 2.24, and earlier does not require administrative authentication for an addupdate action, which allows remote attackers to upload a calendar aka .ics file with arbitrary content to the calendars/ directory outside the web root...

Sql injection

Multiple SQL injection vulnerabilities in admin/usercheck.php in FlexPHPNews 0.0.6 allow remote attackers to execute arbitrary SQL commands via the 1 checkuser parameter aka username field or 2 checkpass parameter aka password field to admin/index.php. NOTE: some of these details are obtained fro...

CVE-2008-5927

CVE-2008-5927 describes multiple SQL injection vulnerabilities in FlexPHPNews 0.0.6, specifically in admin/usercheck.php. The attack surface is the login path at admin/index.php, where user-supplied inputs in the checkuser (username) and checkpass (password) parameters appear to be unsafely handl...

phpList <= 2.10.8 Variable Overwriting

The version of phpList installed on the remote host emulates PHP's 'registerglobals' functionaltiy' insecurely in its 'admin/index.php' script. Provided PHP's 'registerglobals' setting is disabled, an unauthenticated attacker can exploit this issue to overwrite the 'SERVERConfigFile' and...

w3bcms - '/admin/index.php' SQL Injection

source: https://www.securityfocus.com/bid/33310/info The 'w3bcms' application is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, acces...

phpList 2.10.8 - Local File Inclusion

phpList 2.10.8 - Local File Inclusion www.BugReport.ir AmnPardaz Security Research Team Title: phpList Local File inclusion Vendor: http://www.phplist.com Bug: Local File Inclusion Vulnerable Version: 2.10.8 prior versions also may be affected Exploitation: Remote with browser Fix: N/A Original...

CVE-2008-5783: Improper Authentication

admin/index.php in V3 Chat Live Support 3.0.4 allows remote attackers to bypass authentication and gain administrative access by setting the admin cookie to 1...