CVE-2008-6658

CVE-2008-6658 affects Simple Machines Forum (SMF): directory traversal in index.php allows remote authenticated administrators to install packages from arbitrary directories via package parameter during install2, affecting SMF 1.0.x prior to 1.0.15 and SMF 1.1.x prior to 1.1.7. Impact per descrip...

CVE-2008-6641

Multiple SQL injection vulnerabilities in Shader TV Beta allow remote authenticated administrators to execute arbitrary SQL commands via the sid parameter to 1 kanal.asp, 2 google.asp, and 3 hakk.asp in yonet/; and allow remote attackers to execute arbitrary SQL commands via the 4 username or 5...

Sql injection

Multiple SQL injection vulnerabilities in Shader TV Beta allow remote authenticated administrators to execute arbitrary SQL commands via the sid parameter to 1 kanal.asp, 2 google.asp, and 3 hakk.asp in yonet/; and allow remote attackers to execute arbitrary SQL commands via the 4 username or 5...

Code injection

Unspecified vulnerability in the Skin Manager in DotNetNuke before 4.8.2 allows remote authenticated administrators to perform "server-side execution of application logic" by uploading a static file that is converted into a dynamic script via unknown vectors related to HTM or HTML files...

CVE-2008-6542

Unspecified vulnerability in the Skin Manager in DotNetNuke before 4.8.2 allows remote authenticated administrators to perform "server-side execution of application logic" by uploading a static file that is converted into a dynamic script via unknown vectors related to HTM or HTML files...

CVE-2008-6542

Unspecified vulnerability in the Skin Manager in DotNetNuke before 4.8.2 allows remote authenticated administrators to perform "server-side execution of application logic" by uploading a static file that is converted into a dynamic script via unknown vectors related to HTM or HTML files...

CVE-2008-6530

Unrestricted file upload vulnerability in editimage.php in eZoneScripts Living Local 1.1 allows remote authenticated administrators to execute arbitrary PHP code by uploading a file with an executable extension, then accessing it via a direct request to the uploaded file...

CVE-2008-6530

Unrestricted file upload vulnerability in editimage.php in eZoneScripts Living Local 1.1 allows remote authenticated administrators to execute arbitrary PHP code by uploading a file with an executable extension, then accessing it via a direct request to the uploaded file...

Sql injection

Multiple SQL injection vulnerabilities in YAP Blog 1.1.1 allow remote attackers to execute arbitrary SQL commands via the 1 imageid parameter to comments.php, and remote authenticated administrators to execute arbitrary SQL commands via the 2 user parameter in a modif action to admin/index.php...

CVE-2009-1038

Multiple SQL injection vulnerabilities in YAP Blog 1.1.1 allow remote attackers to execute arbitrary SQL commands via the 1 imageid parameter to comments.php, and remote authenticated administrators to execute arbitrary SQL commands via the 2 user parameter in a modif action to admin/index.php...

CVE-2008-6276

Multiple SQL injection vulnerabilities in the User Karma module 5.x before 5.x-1.13 and 6.x before 6.x-1.0-beta1, a module for Drupal, allow remote authenticated administrators to execute arbitrary SQL commands via 1 a content type or 2 a voting API value...

Sql injection

Multiple SQL injection vulnerabilities in the User Karma module 5.x before 5.x-1.13 and 6.x before 6.x-1.0-beta1, a module for Drupal, allow remote authenticated administrators to execute arbitrary SQL commands via 1 a content type or 2 a voting API value...

Sql injection

SQL injection vulnerability in admincp/admincalendar.php in vBulletin 3.7.3.pl1 allows remote authenticated administrators to execute arbitrary SQL commands via the holidayinforecurring parameter, a different vector than CVE-2005-3022...

CVE-2008-6256

SQL injection vulnerability in admincp/admincalendar.php in vBulletin 3.7.3.pl1 allows remote authenticated administrators to execute arbitrary SQL commands via the holidayinforecurring parameter, a different vector than CVE-2005-3022...

CVE-2008-6255

Multiple SQL injection vulnerabilities in vBulletin 3.7.4 allow remote authenticated administrators to execute arbitrary SQL commands via the 1 answer parameter to admincp/verify.php, 2 extension parameter in an edit action to admincp/attachmentpermission.php, and the 3 iperm parameter to...

Sql injection

Multiple SQL injection vulnerabilities in vBulletin 3.7.4 allow remote authenticated administrators to execute arbitrary SQL commands via the 1 answer parameter to admincp/verify.php, 2 extension parameter in an edit action to admincp/attachmentpermission.php, and the 3 iperm parameter to...

Sql injection

SQL injection vulnerability in the ResendEmail module in Raven Web Services RavenNuke 2.30 allows remote authenticated administrators to execute arbitrary SQL commands via the userprefix parameter to modules.php...

CVE-2009-0673

Eval injection vulnerability in the Custom Fields feature in the Your Account module in Raven Web Services RavenNuke 2.30 allows remote authenticated administrators to execute arbitrary PHP code via the ID Field Name box in a yaCustomFields action to admin.php...

Code injection

Static code injection vulnerability in admin.php in Ryneezy phoSheezy 0.2 allows remote authenticated administrators to inject arbitrary PHP code into config/header via the header parameter. NOTE: this can be exploited by unauthenticated attackers by leveraging CVE-2009-0250. NOTE: the provenance...

CVE-2009-0275

Static code injection vulnerability in admin.php in Ryneezy phoSheezy 0.2 allows remote authenticated administrators to inject arbitrary PHP code into config/header via the header parameter. NOTE: this can be exploited by unauthenticated attackers by leveraging CVE-2009-0250. NOTE: the provenance...