CVE-2008-7119

SQL injection vulnerability in item.php in WeBid auction script 0.5.4 allows remote attackers to execute arbitrary SQL commands via the id parameter...

Sql injection

SQL injection vulnerability in item.php in WeBid auction script 0.5.4 allows remote attackers to execute arbitrary SQL commands via the id parameter...

Sql injection

SQL injection vulnerability in the admin panel admin/ in WeBid auction script 0.5.4 allows remote attackers to execute arbitrary SQL commands via the username...

Improper access control

WeBid auction script 0.5.4 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain SQL query logs via a direct request for logs/cron.log...

Cross site scripting

eledicss.php in WeBid auction script 0.5.4 allows remote attackers to modify arbitrary cascading style sheets CSS files via a certain request with the file parameter set to style.css. NOTE: this can probably be leveraged for cross-site scripting XSS attacks...

CVE-2008-7118

WeBid auction script 0.5.4 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain SQL query logs via a direct request for logs/cron.log...

CVE-2008-7117

eledicss.php in WeBid auction script 0.5.4 allows remote attackers to modify arbitrary cascading style sheets CSS files via a certain request with the file parameter set to style.css. NOTE: this can probably be leveraged for cross-site scripting XSS attacks...

CVE-2008-7119

CVE-2008-7119 is a SQL injection vulnerability affecting WeBid auction script 0.5.4, in item.php via the id parameter, allowing remote attackers to execute arbitrary SQL commands. The issue is publicly documented in NVD/NVD-derived records and is corroborated by references to exploit code (e.g., ...

CVE-2008-7117

eledicss.php in WeBid auction script 0.5.4 allows remote attackers to modify arbitrary cascading style sheets CSS files via a certain request with the file parameter set to style.css. NOTE: this can probably be leveraged for cross-site scripting XSS attacks...

CVE-2008-7118

WeBid auction script 0.5.4 stores sensitive information under the web root with insufficient access control, allowing remote attackers to obtain SQL query logs via a direct request for logs/cron.log. No remediation details are provided in the supplied documents; public exploit references exist bu...

CVE-2008-7117

CVE-2008-7117 affects WeBid 0.5.4: eledicss.php lets remote attackers modify arbitrary CSS files (file parameter set to style.css). This could enable cross-site scripting. No further exploit details are provided in the connected documents; no remediation is specified here.

CVE-2008-7116

The vulnerability CVE-2008-7116 affects WeBid auction script 0.5.4 and is an SQL injection in the admin panel (admin/). The underlying issue is injection via the username parameter, allowing remote attackers to execute arbitrary SQL commands. Affected component: admin panel; impact: arbitrary SQL...

CVE-2008-7119

SQL injection vulnerability in item.php in WeBid auction script 0.5.4 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2008-7116: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the admin panel admin/ in WeBid auction script 0.5.4 allows remote attackers to execute arbitrary SQL commands via the username...

CVE-2008-7118: Undefined Security Weakness

WeBid auction script 0.5.4 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain SQL query logs via a direct request for logs/cron.log...

WeBid 0.7.3 RC9 - Multiple Remote File Inclusions

----------------------------------------------------------------------------------------- ECHOADV104$2009 WeBid = 0.7.3 RC9 Multiple Remote File Inclution Vulnerabilities ----------------------------------------------------------------------------------------- Author : K-159 Date : March, 11 th...

WeBid 0.7.3 Remote File Inclusion

ECHOADV104$2009 ----------------------------------------------------------------------------------------- ECHOADV104$2009 WeBid = 0.7.3 RC9 Multiple Remote File Inclution Vulnerabilities ----------------------------------------------------------------------------------------- Author : K-159 Date ...

Sql injection

SQL injection vulnerability in browseproject.php in Freelance Auction Script 1.0 allows remote attackers to execute arbitrary SQL commands via the pid parameter in a pdetails action...

CVE-2008-2278

SQL injection vulnerability in browseproject.php in Freelance Auction Script 1.0 allows remote attackers to execute arbitrary SQL commands via the pid parameter in a pdetails action...

CVE-2008-2279

The CVE-2008-2279 entry concerns Freelance Auction Script 1.0 where user passwords are stored in plaintext in the tbl_users table, enabling attackers to read sensitive credentials and potentially gain privileges. The NVD entry provides a CVSS v2 base score of 5.0 (Medium) with network attack vect...