CVE-2007-5644: Undefined Security Weakness

Lussumo Vanilla 1.1.3 and earlier does not require admin privileges for 1 ajax/sortcategories.php and 2 ajax/sortroles.php, which allows remote attackers to conduct unauthorized sort operations and other activities...

CVE-2007-5643: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Lussumo Vanilla 1.1.3 and earlier allow remote attackers to execute arbitrary SQL commands via 1 the CategoryID parameter to ajax/sortcategories.php or 2 an unspecified vector to ajax/sortroles.php...