EUVD-2006-1614

Malware in sbrugna...

Sql injection

Multiple SQL injection vulnerabilities in aWebNews 1.0 allow remote attackers to execute arbitrary SQL commands via the 1 user123 variable in a login.php or b fpass.php; or 2 cid parameter to c visview.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in visview.php in aWebNews 1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 yname, 2 emailadd, 3 subject, and 4 comment parameters...

CVE-2006-1613

CVE-2006-1613 affects aWebNews 1.0. The vulnerable components are login.php, fpass.php, and visview.php, where unsanitized inputs (user123 variable in login.php/fpass.php; cid in visview.php) are used in SQL queries, enabling remote SQL injection. The vulnerability is described across multiple so...

CVE-2006-1612

Multiple cross-site scripting XSS vulnerabilities in visview.php in aWebNews 1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 yname, 2 emailadd, 3 subject, and 4 comment parameters...

CVE-2006-1613

Multiple SQL injection vulnerabilities in aWebNews 1.0 allow remote attackers to execute arbitrary SQL commands via the 1 user123 variable in a login.php or b fpass.php; or 2 cid parameter to c visview.php...