CVE-2009-0648: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the manageusers handler in admin/index.php in Falt4 CMS aka Falt4 Extreme RC4 allow remote attackers to hijack the authentication of administrators for requests that change passwords via the 1 edit and 2 editnow actions...

CVE-2009-0597

CVE-2009-0597 describes an SQL injection in the w3b>cms (aka w3blabor CMS) admin/index.php before version 3.4.0, exploitable when magic_quotes_gpc is disabled. A remote attacker can inject SQL via the benutzername (Username) field in the login action, potentially executing arbitrary SQL comman...

CVE-2009-0597: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/index.php in w3bcms aka w3blabor CMS before 3.4.0, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the benutzername parameter aka Username field in a login action...

Sql injection

SQL injection vulnerability in A4Desk PHP Event Calendar allows remote attackers to execute arbitrary SQL commands via the eventid parameter to admin/index.php...

CVE-2008-6104

Summary of CVE-2008-6104 (A4Desk Event Calendar SQLi) Affects: A4Desk PHP Event Calendar.Vulnerability: SQL injection via the eventid parameter to admin/index.php, caused by insufficient input sanitization.Impact: Remote attackers could execute arbitrary SQL commands (partial confidentiality/ int...

CVE-2008-6104: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in A4Desk PHP Event Calendar allows remote attackers to execute arbitrary SQL commands via the eventid parameter to admin/index.php...

Directory traversal

Multiple directory traversal vulnerabilities in SG Real Estate Portal 2.0 allow remote attackers to read arbitrary files via a .. dot dot in the 1 mod, 2 page, or 3 lang parameter to index.php; or the 4 action or 5 folder parameter in a security request to admin/index.php...

CVE-2008-5967: Improper Authentication

admin/index.php in PHP iCalendar 2.3.4, 2.24, and earlier does not require administrative authentication for an addupdate action, which allows remote attackers to upload a calendar aka .ics file with arbitrary content to the calendars/ directory outside the web root...

Sql injection

Multiple SQL injection vulnerabilities in admin/usercheck.php in FlexPHPNews 0.0.6 allow remote attackers to execute arbitrary SQL commands via the 1 checkuser parameter aka username field or 2 checkpass parameter aka password field to admin/index.php. NOTE: some of these details are obtained fro...

CVE-2008-5927

CVE-2008-5927 describes multiple SQL injection vulnerabilities in FlexPHPNews 0.0.6, specifically in admin/usercheck.php. The attack surface is the login path at admin/index.php, where user-supplied inputs in the checkuser (username) and checkpass (password) parameters appear to be unsafely handl...

phpList <= 2.10.8 Variable Overwriting

The version of phpList installed on the remote host emulates PHP's 'registerglobals' functionaltiy' insecurely in its 'admin/index.php' script. Provided PHP's 'registerglobals' setting is disabled, an unauthenticated attacker can exploit this issue to overwrite the 'SERVERConfigFile' and...

w3bcms - '/admin/index.php' SQL Injection

source: https://www.securityfocus.com/bid/33310/info The 'w3bcms' application is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, acces...

phpList 2.10.8 - Local File Inclusion

phpList 2.10.8 - Local File Inclusion www.BugReport.ir AmnPardaz Security Research Team Title: phpList Local File inclusion Vendor: http://www.phplist.com Bug: Local File Inclusion Vulnerable Version: 2.10.8 prior versions also may be affected Exploitation: Remote with browser Fix: N/A Original...

CVE-2008-5783: Improper Authentication

admin/index.php in V3 Chat Live Support 3.0.4 allows remote attackers to bypass authentication and gain administrative access by setting the admin cookie to 1...

CVE-2008-5306

An SQL injection vulnerability exists in PG Real Estate Solution: admin/index.php accepts the login_lg (username) parameter in a way that allows remote attackers to execute arbitrary SQL commands. The issue is tied to the login handling code and carries a CVSS v2 base score of 7.5 (HIGH) with par...

CVE-2008-5307

CVE-2008-5307: A SQL injection vulnerability exists in admin/index.php of the PG Roommate Finder Solution, exploitable via the login_lg parameter. The flaw enables remote attackers to execute arbitrary SQL commands. The NVD entry notes this as a high-severity issue (CVSSv2 base score 7.5; AV:N/AC...

CVE-2008-5308: Undefined Security Weakness

The Simple Forum 3.1d module for LoveCMS 1.6.2 Final does not properly restrict access to administrator functions, which allows remote attackers to change the administrator password via a direct request to modules/simpleforum/admin/index.php...

CVE-2008-5306: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/index.php in PG Real Estate Solution allows remote attackers to execute arbitrary SQL commands via the loginlg parameter username. NOTE: some of these details are obtained from third party information...

CVE-2008-5307: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/index.php in PG Roommate Finder Solution allows remote attackers to execute arbitrary SQL commands via the loginlg parameter. NOTE: some of these details are obtained from third party information...

CVE-2008-5131

Multiple SQL injection vulnerabilities in Develop It Easy News And Article System 1.4 allow remote attackers to execute arbitrary SQL commands via 1 the aid parameter to articledetails.php, and the 2 username and 3 password to the admin panel admin/index.php...