Cross site scripting

Cross-site scripting XSS vulnerability in PolyPager 1.0 rc2 and earlier allows remote attackers to inject arbitrary web script or HTML via the nr parameter to the default URI...

CVE-2008-3505

Cross-site scripting XSS vulnerability in PolyPager 1.0 rc2 and earlier allows remote attackers to inject arbitrary web script or HTML via the nr parameter to the default URI...

Sql injection

SQL injection vulnerability in Comsenz EPShop aka ECShop before 3.0 allows remote attackers to execute arbitrary SQL commands via the pid parameter in a 1 proshow or 2 disppro action to the default URI...

Cross site scripting

Cross-site scripting XSS vulnerability in Snark VisualPic 0.3.1 allows remote attackers to inject arbitrary web script or HTML via the pic parameter to the default URI. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-3193

SQL injection vulnerability in jSite 1.0 OE allows remote attackers to execute arbitrary SQL commands via the page parameter to the default URI...

Sql injection

SQL injection vulnerability in jSite 1.0 OE allows remote attackers to execute arbitrary SQL commands via the page parameter to the default URI...

Directory traversal

Directory traversal vulnerability in Easy-Clanpage 3.0 b1 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the section parameter to the default URI...

CVE-2008-2783

Multiple cross-site scripting XSS vulnerabilities in Horde Groupware, Groupware Webmail Edition, and Kronolith allow remote attackers to inject arbitrary web script or HTML via the timestamp parameter to 1 week.php, 2 workweek.php, and 3 day.php; and 4 the horde parameter in the PATHINFO to the...

CVE-2008-2679

SQL injection vulnerability in the KeyWordsList function in includes/incroutines.asp in Realm CMS 2.3 and earlier allows remote attackers to execute arbitrary SQL commands via the kwrd parameter in a kwl action to the default URI...

Sql injection

SQL injection vulnerability in the KeyWordsList function in includes/incroutines.asp in Realm CMS 2.3 and earlier allows remote attackers to execute arbitrary SQL commands via the kwrd parameter in a kwl action to the default URI...

Directory traversal

Multiple directory traversal vulnerabilities in ErfurtWiki R1.02b and earlier, when registerglobals is enabled, allow remote attackers to include and execute arbitrary local files via a .. dot dot in the 1 ewikiid and 2 ewikiaction parameters to fragments/css.php, and possibly the 3 id parameter ...

Cross site scripting

Cross-site scripting XSS vulnerability in the Web GUI in SAP Web Application Server WAS 7.0, Web Dynpro for ABAP aka WD4A or WDA, and Web Dynpro for BSP allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to the default URI under bc/gui/sap/its/webgui/...

Directory traversal

Directory traversal vulnerability in Chilek Content Management System aka ChiCoMaS 2.0.4 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the operation parameter to the default URI under install/...

Directory traversal

Multiple directory traversal vulnerabilities in cpCommerce 1.1.0 allow remote attackers to include and execute arbitrary local files via a .. dot dot in 1 the language parameter in a language action to the default URI, which is not properly handled in actions/language.act.php, or 2 the action...

Sql injection

SQL injection vulnerability in the WP-Forum 1.7.4 plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the user parameter in a showprofile action to the default URI...

CVE-2008-0388

SQL injection vulnerability in the WP-Forum 1.7.4 plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the user parameter in a showprofile action to the default URI...

Default credentials

PRO-Search 0.17 and earlier allows remote attackers to cause a denial of service via certain values of the showpage and time parameters to the default URI...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in PRO-Search 0.17 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 prot, 2 host, 3 path, 4 name, 5 ext, 6 size, 7 searchdays, or 8 showpage parameter to the default URI...

CVE-2008-0199

PRO-Search 0.17 and earlier allows remote attackers to cause a denial of service via certain values of the showpage and time parameters to the default URI...

CVE-2008-0207

Multiple cross-site scripting XSS vulnerabilities in PRO-Search 0.17 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 prot, 2 host, 3 path, 4 name, 5 ext, 6 size, 7 searchdays, or 8 showpage parameter to the default URI...