CVE-2009-4933

Multiple SQL injection vulnerabilities in login.php in EZ Webitor are documented under CVE-2009-4933. The issue is triggered by unvalidated input in two parameters, txtUserId (Username) and txtPassword (Password), allowing remote attackers to execute arbitrary SQL commands. The description consis...

CVE-2009-4933

Multiple SQL injection vulnerabilities in login.php in EZ Webitor allow remote attackers to execute arbitrary SQL commands via the 1 txtUserId Username and 2 txtPassword Password parameters. NOTE: some of these details are obtained from third party information...

CVE-2009-4933: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in login.php in EZ Webitor allow remote attackers to execute arbitrary SQL commands via the 1 txtUserId Username and 2 txtPassword Password parameters. NOTE: some of these details are obtained from third party information...

CVE-2010-2672

Multiple SQL injection vulnerabilities in eZ Publish 3.7.0 through 4.2.0 allow remote attackers to execute arbitrary SQL commands via the 1 SectionID and 2 SearchTimestamp parameters to the search feature and the 3 SearchContentClassAttributeID parameter to the advancedsearch feature...

CVE-2010-2671

Cross-site scripting XSS vulnerability in advancedsearch.php in eZ Publish 3.7.0 through 4.2.0 allows remote attackers to inject arbitrary web script or HTML via the subTreeItem parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in advancedsearch.php in eZ Publish 3.7.0 through 4.2.0 allows remote attackers to inject arbitrary web script or HTML via the subTreeItem parameter...

Sql injection

Multiple SQL injection vulnerabilities in eZ Publish 3.7.0 through 4.2.0 allow remote attackers to execute arbitrary SQL commands via the 1 SectionID and 2 SearchTimestamp parameters to the search feature and the 3 SearchContentClassAttributeID parameter to the advancedsearch feature...

CVE-2010-2671

Cross-site scripting XSS vulnerability in advancedsearch.php in eZ Publish 3.7.0 through 4.2.0 allows remote attackers to inject arbitrary web script or HTML via the subTreeItem parameter...

CVE-2010-2672

Multiple SQL injection vulnerabilities in eZ Publish 3.7.0 through 4.2.0 allow remote attackers to execute arbitrary SQL commands via the 1 SectionID and 2 SearchTimestamp parameters to the search feature and the 3 SearchContentClassAttributeID parameter to the advancedsearch feature...

CVE-2010-2671

CVE-2010-2671 is an XSS vulnerability in eZ Publish versions 3.7.0–4.2.0, triggered via the subTreeItem parameter in advancedsearch.php. The issue allows remote injection of arbitrary web script/HTML. The description identifies the vulnerable component and input, but the provided documents do not...

CVE-2010-2672

The CVE-2010-2672 entry concerns eZ Publish versions 3.7.0–4.2.0. The vulnerability is a set of SQL injection flaws exploitable via user input to the search feature (parameters SectionID and SearchTimestamp) and to the advancedsearch feature (parameter SearchContentClassAttributeID). The underlyi...

CVE-2010-2672

Multiple SQL injection vulnerabilities in eZ Publish 3.7.0 through 4.2.0 allow remote attackers to execute arbitrary SQL commands via the 1 SectionID and 2 SearchTimestamp parameters to the search feature and the 3 SearchContentClassAttributeID parameter to the advancedsearch feature...

CVE-2010-2671

Cross-site scripting XSS vulnerability in advancedsearch.php in eZ Publish 3.7.0 through 4.2.0 allows remote attackers to inject arbitrary web script or HTML via the subTreeItem parameter...

CVE-2010-2672: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in eZ Publish 3.7.0 through 4.2.0 allow remote attackers to execute arbitrary SQL commands via the 1 SectionID and 2 SearchTimestamp parameters to the search feature and the 3 SearchContentClassAttributeID parameter to the advancedsearch feature...

CVE-2010-2671: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in advancedsearch.php in eZ Publish 3.7.0 through 4.2.0 allows remote attackers to inject arbitrary web script or HTML via the subTreeItem parameter...

Sql injection

Multiple SQL injection vulnerabilities in EZ-Blog Beta 1, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via 1 the storyid parameter to public/view.php or 2 the kill parameter to admin/remove.php...

Authentication flaw

EZ-Blog Beta 1 does not require authentication, which allows remote attackers to create or delete arbitrary posts via requests to PHP scripts...

CVE-2009-4801

EZ-Blog Beta 1 does not require authentication, which allows remote attackers to create or delete arbitrary posts via requests to PHP scripts...

CVE-2009-4805

Multiple SQL injection vulnerabilities in EZ-Blog Beta 1, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via 1 the storyid parameter to public/view.php or 2 the kill parameter to admin/remove.php...

CVE-2009-4801

EZ-Blog Beta 1 does not require authentication, which allows remote attackers to create or delete arbitrary posts via requests to PHP scripts...