EUVD-2006-4578

Malware in sbrugna...

Simbas CMS 2.0 (Auth Bypass) SQL Injection Vulnerability

No description provided by source. ----------------------------------------------------- ----------------------------------------------------- Simbas Content Management System auth Bypass Remote Sql Injecion ----------------------------------------------------- Founder: ThE g0bL!NDz Home:...

CVE-2008-6204: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in SuperNET Shop 1.0 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 id parameter to secure/admin/guncelle.asp, 2 kulad and sifre parameters to secure/admin/giris.asp, and 3 username and password to secure/admin/default.asp...

CVE-2008-2048

The documents confirm a Cross-site scripting (XSS) vulnerability in Angelo-Emlak 1.0, specifically in hpz/admin/Default.asp, exploitable via the sayfa parameter. This affects Angelo-Emlak 1.0 and allows remote attackers to inject arbitrary web script or HTML. The root cause is an XSS flaw in the ...

CVE-2007-1471: Undefined Security Weakness

admin/default.asp in Orion-Blog 2.0 allows remote attackers to bypass authentication controls and gain privileges via a direct URL request for admin/AdminBlogNewsEdit.asp...

CVE-2006-6927

Multiple SQL injection vulnerabilities in Rialto 1.6 allow remote attackers to execute arbitrary SQL commands via 1 the uname username and 2 pword passwd fields in a admin/default.asp; the 3 ID parameter to b listfull.asp or c printmain.asp; the 4 cat parameter to d listmain.asp, e...

CVE-2006-6927: Undefined Security Weakness

Multiple SQL injection vulnerabilities in Rialto 1.6 allow remote attackers to execute arbitrary SQL commands via 1 the uname username and 2 pword passwd fields in a admin/default.asp; the 3 ID parameter to b listfull.asp or c printmain.asp; the 4 cat parameter to d listmain.asp, e...

CVE-2006-6455

Multiple SQL injection vulnerabilities in admin/default.asp in DUware DUdirectory 3.1, and possibly DUdirectory Pro and Pro SQL 3.x, allow remote attackers to execute arbitrary SQL commands via the 1 Username or 2 Password parameter. NOTE: some of these details are obtained from third party...

CVE-2006-6455

CVE-2006-6455 affects DUware DUdirectory 3.1 (and possibly DUdirectory Pro/Pro SQL 3.x). The vulnerability is multiple SQL injections in admin/default.asp that allow remote attackers to execute arbitrary SQL via the Username or Password parameters. This entry derives from third‑party information ...

CVE-2006-6455: Undefined Security Weakness

Multiple SQL injection vulnerabilities in admin/default.asp in DUware DUdirectory 3.1, and possibly DUdirectory Pro and Pro SQL 3.x, allow remote attackers to execute arbitrary SQL commands via the 1 Username or 2 Password parameter. NOTE: some of these details are obtained from third party...

CVE-2006-6030

Multiple SQL injection vulnerabilities in E-Calendar Pro 3.0 allow remote attackers to execute arbitrary SQL commands via the 1 username and 2 passwd Password fields in a admin/default.asp; or the 3 Event Title, 4 Location, or 5 Description field when making a search engine query in b search.asp...

CVE-2006-6030

Multiple SQL injection vulnerabilities affect E-Calendar Pro 3.0. Remote attackers can execute arbitrary SQL via (1) username and (2) passwd fields in admin/default.asp or (3) Event Title, (4) Location, or (5) Description in search.asp, as described for CVE-2006-6030. The underlying issue is impr...

CVE-2006-6030: Undefined Security Weakness

Multiple SQL injection vulnerabilities in E-Calendar Pro 3.0 allow remote attackers to execute arbitrary SQL commands via the 1 username and 2 passwd Password fields in a admin/default.asp; or the 3 Event Title, 4 Location, or 5 Description field when making a search engine query in b search.asp...

CVE-2006-5952: Undefined Security Weakness

SQL injection vulnerability in admin/default.asp in ASP Smiley 1.0 allows remote attackers to execute arbitrary SQL commands via the Username field...

CVE-2006-5934: Undefined Security Weakness

SQL injection vulnerability in admin/default.asp in Estate Agent Manager 1.3 and earlier allows remote attackers to execute arbitrary SQL commands via the UserName field...

CVE-2006-4590

CVE-2006-4463 and CVE-2006-4590 describe SQL injection flaws in Jetstat.com JS ASP Faq Manager 1.10 and earlier. CVE-2006-4463 affects the administrator control panel via the pwd parameter; CVE-2006-4590 affects admin/default.asp via the uid parameter. Both allow remote attackers to potentially e...

CVE-2006-4590: Undefined Security Weakness

SQL injection vulnerability in admin/default.asp in Jetstat.com JS ASP Faq Manager 1.10 and earlier allows remote attackers to execute arbitrary SQL commands via the uid parameter, a different vector than CVE-2006-4463. NOTE: the provenance of this information is unknown; the details are obtained...

CVE-2006-2822: Undefined Security Weakness

SQL injection vulnerability in admin/default.asp in Dusan Drobac CodeAvalanche FreeForum aka CAForum 1.0 allows remote attackers to execute arbitrary SQL commands via the password parameter...

CVE-2005-4396

Cross-site scripting XSS vulnerability in admin/Default.asp in iCMS allows remote attackers to inject arbitrary web script or HTML via the LoginMSG parameter. NOTE: the provenance of this issue is unknown; the details were obtained solely from third party sources...

CVE-2005-4355: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in UStore allow remote attackers to inject arbitrary web script or HTML via the 1 Cat parameter in default.asp and the 2 accessdenied parameter in admin/default.asp. NOTE: the provenance of this information is unknown; the details are obtained...