CVE-2006-5942

CVE-2006-5942 describes a Cross-site scripting (XSS) vulnerability in the Inventory Manager component of Website Designs For Less. The flaw occurs in inventory/display/display_results.asp, exploitable via the category parameter to inject arbitrary script/HTML. Affected: Inventory Manager; Impact:...

CVE-2006-5943

CVE-2006-5943 describes multiple SQL injection vulnerabilities in inventory/display/imager.asp of Website Designs for Less Inventory Manager. The flaw allows remote attackers to inject SQL via the pictable, picfield, or where parameters, potentially leading to arbitrary SQL execution. The affecte...

CVE-2006-5893

Multiple PHP remote file inclusion vulnerabilities in iWonder Designs Storystream 0.4.0.0 allow remote attackers to execute arbitrary PHP code via a URL in the baseDir parameter to 1 mysql.php and 2 mysqli.php in include/classes/pear/DB/...

CVE-2006-5893

CVE-2006-5893 affects iWonder Designs Storystream 0.4.0.0. The issue is multiple PHP remote file inclusion vulnerabilities allowing an attacker to execute arbitrary PHP code via a URL in the baseDir parameter to include/classes/pear/DB/mysql.php and include/classes/pear/DB/mysqli.php. According t...

CVE-2006-5183

CVE-2006-5183 affects Dayfox Designs Dayfox Blog 2.0 and involves multiple PHP remote file inclusion flaws in the /edit scripts (adminlog.php, postblog.php, index.php, index2.php). The underlying issue is unsafely constructed URLs in the slogin parameter, allowing an attacker to supply a remote P...

Sql injection

SQL injection vulnerability in poems.php in DCI-Designs Dawaween 1.03 allows remote attackers to execute arbitrary SQL commands via the id parameter in a diwan view action...

CVE-2006-1018

SQL injection vulnerability in poems.php in DCI-Designs Dawaween 1.03 allows remote attackers to execute arbitrary SQL commands via the id parameter in a diwan view action...

CVE-2006-1018

The CVE-2006-1018 entry describes an SQL injection in poems.php of DCI-Designs Dawaween 1.03, exploitable via the id parameter in a diwan view action. Affected software: Dawaween 1.03 (poems.php). Root cause: unsanitized id parameter leading to arbitrary SQL execution. Impact per CVSS: Confidenti...

DCI-Designs Dawaween 1.03 - 'Poems.php' SQL Injection

source: https://www.securityfocus.com/bid/16909/info Dawaween is prone to an SQL-injection vulnerability because it fails to properly sanitize user-supplied input before using it in an SQL query. Successful exploits could allow a remote attacker to compromise the application, access or modify dat...

CVE-2004-2524

clogin.php in Benchmark Designs' WHM AutoPilot 2.4.5 and earlier allows remote attackers to obtain plaintext username and password credentials by using the clogine and base64encode functions to encode the desired user ID in the c parameter, then read the plaintext values in the resulting form...

[SA13504] 68 Designs Froogle Installation Security Issue

TITLE: 68 Designs Froogle Installation Security Issue SECUNIA ADVISORY ID: SA13504 VERIFY ADVISORY: http://secunia.com/advisories/13504/ CRITICAL: Less critical IMPACT: Security Bypass WHERE: From remote SOFTWARE: 68 Designs Froogle 1.x http://secunia.com/product/4391/ DESCRIPTION: Lostmon has...

CVE-2002-0110

Nevrona Designs MiraMail 1.04 and earlier stores authentication information such as POP usernames and passwords in plaintext in a .ini file, which allows an attacker to gain privileges by reading the passwords from the file...

CVE-2002-0110

Nevrona Designs MiraMail (Windows) up to version 1.04 stores user credentials (POP usernames and passwords) in plaintext in an .ini file. The underlying issue is unencrypted storage of authentication data, allowing anyone with file access to read passwords and potentially gain privileges. Public ...