CVE-2008-2764

Cross-site scripting XSS vulnerability in admin/search.asp in Xigla Absolute Live Support XE 5.1 allows remote authenticated administrators to inject arbitrary web script or HTML via unspecified vectors "all fields"...

CVE-2008-2761

Multiple cross-site scripting XSS vulnerabilities in Xigla Absolute Banner Manager XE 2.0 allow remote authenticated administrators to inject arbitrary web script or HTML via the text parameter in 1 searchbanners.asp and 2 listadvertisers.asp, and other unspecified fields. NOTE: some of these...

CVE-2008-2757

The CVE-2008-2757 entry affects Xigla Absolute News Manager XE 3.2. Affected component: search.asp. Root cause: SQL injection via the orderby parameter, enabling remote authenticated administrators to execute arbitrary SQL commands. Impact: allows manipulation of backend databases (as described),...

Sql injection

Multiple SQL injection vulnerabilities in admin/adminindex.php in Turnkey Web Tools SunShop Shopping Cart 4.1.0 allow remote authenticated administrators to execute arbitrary SQL commands via the 1 orderby and 2 sort parameters. NOTE: the provenance of this information is unknown; the details are...

CVE-2008-2038

Multiple SQL injection vulnerabilities in admin/adminindex.php in Turnkey Web Tools SunShop Shopping Cart 4.1.0 allow remote authenticated administrators to execute arbitrary SQL commands via the 1 orderby and 2 sort parameters. NOTE: the provenance of this information is unknown; the details are...

CVE-2008-1988

Unrestricted file upload vulnerability in the fileupload function in core/misc.class.php in EncapsGallery 2.0.2 allows remote authenticated administrators to upload and execute arbitrary PHP files by uploading a file with an executable extension, then accessing it via a direct request to the file...

CVE-2008-1495

Unrestricted file upload vulnerability in administrer/produits.php in PEEL, possibly 3.x and earlier, allows remote authenticated administrators to upload and execute arbitrary PHP files via a modified content type in an ajout action, as demonstrated by 1 image/gif and 2 application/pdf...

CVE-2007-6319

Multiple unspecified vulnerabilities in Lyris ListManager 8.x before 8.95d, 9.2 before 9.2c, and 9.3 before 9.3b allow remote attackers to 1 gain list administrator privileges or 2 access arbitrary mailing lists via unknown vectors related to modification of client-side information; and 3 allow...

Sql injection

SQL injection vulnerability in the administration panel in the DMSGuestbook 1.7.0 plugin for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via unspecified vectors. NOTE: it is not clear whether this issue crosses privilege boundaries...

CVE-2008-0616

SQL injection vulnerability in the administration panel in the DMSGuestbook 1.7.0 plugin for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via unspecified vectors. NOTE: it is not clear whether this issue crosses privilege boundaries...

WordPress DMSGuestbook Plugin <= 1.7.0 - SQL Injection

Because of this vulnerability in the administration panel, the authenticated administrators can execute arbitrary SQL commands via unspecified vectors. Solution Update the plugin...

Sql injection

Multiple SQL injection vulnerabilities in Coppermine Photo Gallery CPG before 1.4.15 allow remote authenticated administrators to execute arbitrary SQL commands via the 1 albumid, 2 startpic, and 3 numpics parameters to util.php; and 4 cidarray parameter to reviewcom.php...

CVE-2008-0504

Multiple SQL injection vulnerabilities in Coppermine Photo Gallery CPG before 1.4.15 allow remote authenticated administrators to execute arbitrary SQL commands via the 1 albumid, 2 startpic, and 3 numpics parameters to util.php; and 4 cidarray parameter to reviewcom.php...

CVE-2008-0504

Multiple SQL injection vulnerabilities in Coppermine Photo Gallery CPG before 1.4.15 allow remote authenticated administrators to execute arbitrary SQL commands via the 1 albumid, 2 startpic, and 3 numpics parameters to util.php; and 4 cidarray parameter to reviewcom.php...

Sql injection

Multiple SQL injection vulnerabilities in Digital Hive 2.0 RC2 and earlier allow 1 remote attackers to execute arbitrary SQL commands via the selectskin parameter to an unspecified program, or 2 remote authenticated administrators to execute arbitrary SQL commands via the userid parameter in the...

CVE-2008-0290

Affected software: Digital Hive 2.0 RC2 and earlier. The CVE describes two SQL injection vectors: (1) via the selectskin parameter to an unspecified program, allowing remote execution of arbitrary SQL commands; (2) via the user_id parameter in gestione_membre.php to base.php, allowing remote auth...

CVE-2008-0267

Multiple SQL injection vulnerabilities in eTicket 1.5.5.2 allow remote authenticated users to execute arbitrary SQL commands via the 1 status, 2 sort, and 3 way parameters to search.php; and allow remote authenticated administrators to execute arbitrary SQL commands via the 4 msg and 5 password...

CVE-2007-6548

Multiple direct static code injection vulnerabilities in RunCMS before 1.6.1 allow remote authenticated administrators to inject arbitrary PHP code via the 1 header and 2 footer parameters to modules/system/admin.php in a meta-generator action, 3 the disclaimer parameter to modules/system/admin.p...

Code injection

Multiple direct static code injection vulnerabilities in RunCMS before 1.6.1 allow remote authenticated administrators to inject arbitrary PHP code via the 1 header and 2 footer parameters to modules/system/admin.php in a meta-generator action, 3 the disclaimer parameter to modules/system/admin.p...

CVE-2007-6548

Multiple direct static code injection vulnerabilities in RunCMS before 1.6.1 allow remote authenticated administrators to inject arbitrary PHP code via the 1 header and 2 footer parameters to modules/system/admin.php in a meta-generator action, 3 the disclaimer parameter to modules/system/admin.p...