CVE-2008-2280

CVE-2008-2280 describes a cross-site scripting (XSS) vulnerability in admin/index.php of Script PHP PicEngine 1.0. The vulnerability allows remote attackers to inject arbitrary web script or HTML via the l parameter. The description notes the information provenance as third-party. The provided do...

CVE-2008-2280: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/index.php in Script PHP PicEngine 1.0 allows remote attackers to inject arbitrary web script or HTML via the l parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-2207

The CVE-2008-2207 entry covers a Cross-site Scripting (XSS) vulnerability in Maian Gallery 2.0, specifically in admin/index.php where the keywords parameter of a search action can be exploited to inject arbitrary script/HTML by an unauthenticated remote attacker. The affected component is Maian G...

CVE-2008-2207: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/index.php in Maian Gallery 2.0 allows remote attackers to inject arbitrary web script or HTML via the keywords parameter in a search action...

CVE-2008-2200: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Maian Weblog 4.0 allow remote attackers to inject arbitrary web script or HTML via the 1 keywords parameter to admin/index.php in a blogs search action, the 2 msgcharset and 3 msgheader9 parameters to admin/inc/header.php, and the 4 keywords...

CVE-2008-0428: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the login function in system/classpermissions.php in bloofoxCMS 0.3 allow remote attackers to execute arbitrary SQL commands via the 1 username or 2 password parameter to admin/index.php...

Sql injection

Multiple SQL injection vulnerabilities in aliTalk 1.9.1.1, when magicquotesgpc is disabled, allow remote authenticated users to execute arbitrary SQL commands via 1 the mohit parameter to a inc/receivertwo.php; and allow remote attackers to execute arbitrary SQL commands via 2 the id parameter to...

CVE-2008-0371

Multiple SQL injection vulnerabilities in aliTalk 1.9.1.1, when magicquotesgpc is disabled, allow remote authenticated users to execute arbitrary SQL commands via 1 the mohit parameter to a inc/receivertwo.php; and allow remote attackers to execute arbitrary SQL commands via 2 the id parameter to...

CVE-2008-0371: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in aliTalk 1.9.1.1, when magicquotesgpc is disabled, allow remote authenticated users to execute arbitrary SQL commands via 1 the mohit parameter to a inc/receivertwo.php; and allow remote attackers to execute arbitrary SQL commands via 2 the id parameter to...

CVE-2008-0350

admin/index.php in Evilsentinel 1.0.9 and earlier sends a redirect to the web browser but does not exit, which allows remote attackers to gain administrative privileges and make arbitrary configuration changes...

CVE-2008-0350

admin/index.php in Evilsentinel 1.0.9 and earlier sends a redirect to the web browser but does not exit, which allows remote attackers to gain administrative privileges and make arbitrary configuration changes...

CVE-2008-0350

CVE-2008-0350 affects Evilsentinel 1.0.9 and earlier. Admin/index.php redirects without exiting, enabling remote attackers to gain administrative privileges and perform arbitrary configuration changes. The NVD entry notes a network-exposed vulnerability with partial impact to confidentiality, int...

CVE-2008-0350: Undefined Security Weakness

admin/index.php in Evilsentinel 1.0.9 and earlier sends a redirect to the web browser but does not exit, which allows remote attackers to gain administrative privileges and make arbitrary configuration changes...

CVE-2007-6548: Improper Control of Generation of Code

Multiple direct static code injection vulnerabilities in RunCMS before 1.6.1 allow remote authenticated administrators to inject arbitrary PHP code via the 1 header and 2 footer parameters to modules/system/admin.php in a meta-generator action, 3 the disclaimer parameter to modules/system/admin.p...

CVE-2007-6310

Multiple cross-site scripting XSS vulnerabilities in Falt4Extreme RC4 10.9.2007 allow remote attackers to inject arbitrary web script or HTML via the handler parameter to 1 index.php and possibly 2 admin/index.php, and 3 the topic parameter to modules/feed/feed.php aka modules/feed.php...

CVE-2007-6311: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in 1 index.php, and possibly 2 admin/index.php, in Falt4Extreme RC4 10.9.2007 allows remote attackers to execute arbitrary SQL commands via the navID parameter...

CVE-2007-6083

IceBB 1.0-rc6 contains a SQL injection in admin/index.php exploitable via the X-Forwarded-For HTTP header. Remote attackers can execute arbitrary SQL commands. The connected documents confirm the affected software and vulnerability class, but do not provide remediation steps or patched versions. ...

CVE-2007-6083: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/index.php in IceBB 1.0-rc6 allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For HTTP header...

CVE-2007-5952: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/index.php in Helios Calendar 1.2.1 Beta allows remote attackers to inject arbitrary web script or HTML via the username parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2007-5841: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in admin/index.php in nuBoard 0.5 allows remote attackers to execute arbitrary PHP code via a URL in the site parameter...