CVE-2008-0267

Multiple SQL injection vulnerabilities in eTicket 1.5.5.2 allow remote authenticated users to execute arbitrary SQL commands via the 1 status, 2 sort, and 3 way parameters to search.php; and allow remote authenticated administrators to execute arbitrary SQL commands via the 4 msg and 5 password...

CVE-2007-6548

Multiple direct static code injection vulnerabilities in RunCMS before 1.6.1 allow remote authenticated administrators to inject arbitrary PHP code via the 1 header and 2 footer parameters to modules/system/admin.php in a meta-generator action, 3 the disclaimer parameter to modules/system/admin.p...

Code injection

Multiple direct static code injection vulnerabilities in RunCMS before 1.6.1 allow remote authenticated administrators to inject arbitrary PHP code via the 1 header and 2 footer parameters to modules/system/admin.php in a meta-generator action, 3 the disclaimer parameter to modules/system/admin.p...

CVE-2007-6548

Multiple direct static code injection vulnerabilities in RunCMS before 1.6.1 allow remote authenticated administrators to inject arbitrary PHP code via the 1 header and 2 footer parameters to modules/system/admin.php in a meta-generator action, 3 the disclaimer parameter to modules/system/admin.p...

Sql injection

Multiple SQL injection vulnerabilities in phpMyRealty PMR 1.0.9 allow 1 remote attackers to execute arbitrary SQL commands via the type parameter to search.php and 2 remote authenticated administrators to execute arbitrary SQL commands via the listingupdateddays parameter to admin/findlistings.ph...

CVE-2007-6472

Multiple SQL injection vulnerabilities in phpMyRealty PMR 1.0.9 allow 1 remote attackers to execute arbitrary SQL commands via the type parameter to search.php and 2 remote authenticated administrators to execute arbitrary SQL commands via the listingupdateddays parameter to admin/findlistings.ph...

CVE-2007-6472

Multiple SQL injection vulnerabilities in phpMyRealty PMR 1.0.9 allow 1 remote attackers to execute arbitrary SQL commands via the type parameter to search.php and 2 remote authenticated administrators to execute arbitrary SQL commands via the listingupdateddays parameter to admin/findlistings.ph...

Code injection

Direct static code injection vulnerability in dirsys/modules/config/post.php in JBC Explorer 7.20 RC1 and earlier allows remote authenticated administrators to inject arbitrary PHP code via the DEBUG parameter, which can be executed by accessing config.inc.php. NOTE: this can be exploited by...

Code injection

Direct static code injection vulnerability in the download module in Flatnuke 3 allows remote authenticated administrators to inject arbitrary PHP code into a description.it.php file in a subdirectory of Download/ by saving a description and setting fneditmode to 1. NOTE: unauthenticated remote...

Code injection

Unspecified vulnerability in the Settings component in the administration system in Jeebles Directory 2.9.60 allows remote authenticated administrators to execute arbitrary PHP code via unspecified vectors related to settings.inc.php. NOTE: the provenance of this information is unknown; the detai...

CVE-2007-5453

Multiple eval injection vulnerabilities in Php-Stats 0.1.9.2 allow remote authenticated administrators to execute arbitrary code by writing PHP sequences to the php-stats-options record in the options table, which is used in an eval function call by 1 admin.php, 2 click.php, 3 download.php, and...

Sql injection

Multiple eval injection vulnerabilities in Php-Stats 0.1.9.2 allow remote authenticated administrators to execute arbitrary code by writing PHP sequences to the php-stats-options record in the options table, which is used in an eval function call by 1 admin.php, 2 click.php, 3 download.php, and...

CVE-2007-5453

Multiple eval injection vulnerabilities in Php-Stats 0.1.9.2 allow remote authenticated administrators to execute arbitrary code by writing PHP sequences to the php-stats-options record in the options table, which is used in an eval function call by 1 admin.php, 2 click.php, 3 download.php, and...

CVE-2007-4976

Directory traversal vulnerability in viewlog.php in Coppermine Photo Gallery CPG 1.4.12 and earlier allows remote authenticated administrators to include and execute arbitrary local files via a .. dot dot in the log parameter...

Directory traversal

Directory traversal vulnerability in viewlog.php in Coppermine Photo Gallery CPG 1.4.12 and earlier allows remote authenticated administrators to include and execute arbitrary local files via a .. dot dot in the log parameter...

CVE-2007-4976

Directory traversal vulnerability in viewlog.php in Coppermine Photo Gallery CPG 1.4.12 and earlier allows remote authenticated administrators to include and execute arbitrary local files via a .. dot dot in the log parameter...

Sql injection

Multiple SQL injection vulnerabilities in JBlog 1.0 allow 1 remote attackers to execute arbitrary SQL commands via the id parameter to index.php, and allow 2 remote authenticated administrators to execute arbitrary SQL commands via the id parameter to admin/modifpost.php...

CVE-2007-4919

Multiple SQL injection vulnerabilities in JBlog 1.0 allow 1 remote attackers to execute arbitrary SQL commands via the id parameter to index.php, and allow 2 remote authenticated administrators to execute arbitrary SQL commands via the id parameter to admin/modifpost.php...

CVE-2007-4717

Multiple cross-site scripting XSS vulnerabilities in Claroline before 1.8.6 allow remote authenticated administrators to inject arbitrary web script or HTML via the 1 dir parameter in admin/adminusers.php, the 2 action parameter in admin/advancedUserSearch.php, and the 3 view parameter in...

Cross site scripting

Cross-site scripting XSS vulnerability in Forms/General1 in the management interface in ZyNOS firmware 3.62WK.6 on the Zyxel Zywall 2 device allows remote authenticated administrators to inject arbitrary web script or HTML via the sysSystemName parameter...