CVE-2011-2917: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in administrator/index2.php in Mambo CMS 4.6.5 and earlier allows remote attackers to execute arbitrary SQL commands via the zorder parameter...

CVE-2008-7214: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in administrator/index2.php in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to hijack the authentication of administrators for requests that add new administrator accounts via the save task in a comusers action, as...