PT-2005-5482 · Unknown · Land Down Under

Name of the Vulnerable Software and Affected Versions: Land Down Under LDU versions v801 and earlier Description: The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via parameters including 1 the m parameter in "auth.php", 2 the f parameter in "events.php", ...

CVE-2005-4371

Acidcat 2.1.13 and earlier stores the database under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a request to databases/acidcat.mdb...

CVE-2004-2551: Undefined Security Weakness

Multiple SQL injection vulnerabilities in Layton HelpBox 3.0.1 allow remote attackers to execute arbitrary SQL commands via 1 the syscommentid parameter in editcommentenduser.asp, 2 the syssuspendid parameter in editsuspensionuser.asp, 3 the table parameter in exportdata.asp, 4 the sysanalgroup...

ActiveCampaign 1-2-All Broadcast Email 4.0 - Admin Control Panel Username SQL Injection

ActiveCampaign 1-2-All Broadcast Email 4.0 - Admin Control Panel Username SQL Injection source: https://www.securityfocus.com/bid/15400/info ActiveCampaign 1-2-All Broadcast Email is prone to an SQL-injection vulnerability. This is an input-validation issue related to data that will be used in SQ...

PHPWebThings 1.4 - download.php?File SQL Injection

PHPWebThings 1.4 - download.php?File SQL Injection source: https://www.securityfocus.com/bid/15399/info phpWebThings is prone to an SQL injection vulnerability. This is an input validation issue related to data that will be used in SQL queries, allowing a remote user to influence the structure an...

ActiveCampaign 1-2-All Broadcast Email 4.0 - Admin Control Panel 'Username' SQL Injection

source: https://www.securityfocus.com/bid/15400/info ActiveCampaign 1-2-All Broadcast Email is prone to an SQL-injection vulnerability. This is an input-validation issue related to data that will be used in SQL queries, allowing a remote user to influence the structure and logic of a query...

PHPWebThings 1.4 - 'download.php?File' SQL Injection

source: https://www.securityfocus.com/bid/15399/info phpWebThings is prone to an SQL injection vulnerability. This is an input validation issue related to data that will be used in SQL queries, allowing a remote user to influence the structure and logic of a query. It is likely that the issue cou...

CVE-2005-3209

Aenovo products 1 aeNovo, 2 aeNovoShop, and 3 aeNovoWYSI store password information in plaintext in the a control, b content, and c page tables, which allows attackers with database access to obtain those passwords and gain privileges...

CVE-2005-3209

Aenovo products 1 aeNovo, 2 aeNovoShop, and 3 aeNovoWYSI store password information in plaintext in the a control, b content, and c page tables, which allows attackers with database access to obtain those passwords and gain privileges...

CVE-2005-3209: Undefined Security Weakness

Aenovo products 1 aeNovo, 2 aeNovoShop, and 3 aeNovoWYSI store password information in plaintext in the a control, b content, and c page tables, which allows attackers with database access to obtain those passwords and gain privileges...

Cyphor 0.19 - footer.php?t_login Cross-Site Scripting

Cyphor 0.19 - footer.php?tlogin Cross-Site Scripting source: https://www.securityfocus.com/bid/15047/info Cyphor is prone to multiple cross-site scripting and SQL injection vulnerabilities. Exploitation could allow for theft of cookie-based authentication credentials or unauthorized access to...

Cyphor 0.19 - 'newmsg.php?fid' SQL Injection

source: https://www.securityfocus.com/bid/15047/info Cyphor is prone to multiple cross-site scripting and SQL injection vulnerabilities. Exploitation could allow for theft of cookie-based authentication credentials or unauthorized access to database data. Other attacks are also possible...

Cyphor 0.19 - newmsg.php?fid SQL Injection

Cyphor 0.19 - newmsg.php?fid SQL Injection source: https://www.securityfocus.com/bid/15047/info Cyphor is prone to multiple cross-site scripting and SQL injection vulnerabilities. Exploitation could allow for theft of cookie-based authentication credentials or unauthorized access to database data...

CVE-2005-3112

The "reset password" feature in Macromedia Breeze 5.0 stores passwords in plaintext in the database instead of the hash, which allows attackers with access to the database to obtain the passwords...

CVE-2005-3112

The "reset password" feature in Macromedia Breeze 5.0 stores passwords in plaintext in the database instead of the hash, which allows attackers with access to the database to obtain the passwords...

PluggedOut CMS 0.4.8 - contenttypeid SQL Injection

PluggedOut CMS 0.4.8 - contenttypeid SQL Injection source: https://www.securityfocus.com/bid/14426/info PluggedOut CMS is prone to multiple cross-site scripting and SQL injection vulnerabilities. Exploitation could allow for theft of cookie-based authentication credentials or unauthorized access ...

CVE-2005-3112: Undefined Security Weakness

The "reset password" feature in Macromedia Breeze 5.0 stores passwords in plaintext in the database instead of the hash, which allows attackers with access to the database to obtain the passwords...

PluggedOut CMS 0.4.8 - 'contenttypeid' SQL Injection

source: https://www.securityfocus.com/bid/14426/info PluggedOut CMS is prone to multiple cross-site scripting and SQL injection vulnerabilities. Exploitation could allow for theft of cookie-based authentication credentials or unauthorized access to database data. Other attacks are also possible...

phpWebSite: Arbitrary command execution through XML-RPC and SQL injection

Background phpWebSite is a web site content management system. Description phpWebSite uses an XML-RPC library that improperly handles XML-RPC requests and responses with malformed nested tags. Furthermore, "matrixkiller" reported that phpWebSite is vulnerable to an SQL injection attack. Impact A...

ASP-Nuke <= 0.80 comment_post.asp远程SQL注入漏洞

ASPNuke中存在SQL注入漏洞，远程攻击者可以利用此漏洞非授权访问数据库。 起因是没有正确的过滤用户输入。请看/module/support/task/commentpost.asp的第36行和第75行代码： ... nTaskID = steNForm TaskID ... If sErrorMsg = Then prevent dup posting here sStat = SELECT TaskID & FROM tblTaskComment & WHERE TaskID = & nTaskID & & AND Subject = & ReplacesSubject, , &...