vCard PRO - 'create.php?card_id' SQL Injection

source: https://www.securityfocus.com/bid/18699/info VCard PRO is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. A successful exploit could allow an attacker to compromi...

CVE-2006-1230

Multiple cross-site scripting XSS vulnerabilities in create.php in vCard 2.x allow remote attackers to inject arbitrary web script or HTML via the 1 cardid, 2 uploaded, 3 cardfontsize, or 4 cardcolor parameter. NOTE: the cardid vector was later reported to affect vCard 2.9, and the uploaded vecto...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in create.php in vCard 2.x allow remote attackers to inject arbitrary web script or HTML via the 1 cardid, 2 uploaded, 3 cardfontsize, or 4 cardcolor parameter. NOTE: the cardid vector was later reported to affect vCard 2.9, and the uploaded vecto...

CVE-2006-1230

Multiple cross-site scripting XSS vulnerabilities in create.php in vCard 2.x allow remote attackers to inject arbitrary web script or HTML via the 1 cardid, 2 uploaded, 3 cardfontsize, or 4 cardcolor parameter. NOTE: the cardid vector was later reported to affect vCard 2.9, and the uploaded vecto...

CVE-2006-1230

CVE-2006-1230 describes multiple cross-site scripting (XSS) flaws in create.php of vCard 2.x, allowing remote injection of arbitrary script/HTML via (1) card_id, (2) uploaded, (3) card_fontsize, or (4) card_color parameters. The note indicates the card_id vector was later reported to affect vCard...

CVE-2006-1230: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in create.php in vCard 2.x allow remote attackers to inject arbitrary web script or HTML via the 1 cardid, 2 uploaded, 3 cardfontsize, or 4 cardcolor parameter. NOTE: the cardid vector was later reported to affect vCard 2.9, and the uploaded vecto...

CVE-2006-0312

create.php in aoblogger 2.3 allows remote attackers to bypass authentication and create new blog entries by setting the uza parameter to 1...

CVE-2006-0312: Undefined Security Weakness

create.php in aoblogger 2.3 allows remote attackers to bypass authentication and create new blog entries by setting the uza parameter to 1...

Widget Imprint SQL inj. vuln.

Widget Imprint SQL inj. vuln. Vuln. dicovered by : r0t Date: 5 dec. 2005 Orginal advisory:http://pridels.blogspot.com/2005/12/widget-imprint-sql-inj-vuln.html Vendor:http://www.widgetpress.com/products?product=wimprint affected version: 1.0.26 and prior Product Description: Database driven web...

CVE-2005-4020: Undefined Security Weakness

SQL injection vulnerability in create.php in Widget Imprint 1.0.26 and earlier allows remote attackers to execute arbitrary SQL commands via the productid parameter...

CVE-2005-3645: Exposure of Sensitive Information to an Unauthorized Actor

phpAdsNew and phpPgAds 2.0.6 and possibly earlier versions allows remote attackers to obtain the application installation path and other sensitive information via direct requests to 1 create.php, and if displayerrors is enabled, 2 lib-updates.inc.php, 3 lib-targetstats.inc.php, 4 lib-size.inc.php...