CVE-2006-2927

The CVE-2006-2927 entry concerns CodeAvalanche FreeForum (aka CAForum) 1.0, where multiple XSS vulnerabilities exist in post.asp. The affected component is the post.asp handler; the vulnerability allows an attacker to inject arbitrary script or HTML via the msg_subject or msg_body parameters. The...

CVE-2006-2927: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in post.asp in CodeAvalanche FreeForum aka CAForum 1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 msgsubject and 2 msgbody parameters. NOTE: The provenance of this information is unknown; the details are obtained solel...

Sql injection

SQL injection vulnerability in admin/default.asp in Dusan Drobac CodeAvalanche FreeForum aka CAForum 1.0 allows remote attackers to execute arbitrary SQL commands via the password parameter...

CVE-2006-2822

SQL injection vulnerability in admin/default.asp in Dusan Drobac CodeAvalanche FreeForum aka CAForum 1.0 allows remote attackers to execute arbitrary SQL commands via the password parameter...

CVE-2006-2822

SQL injection vulnerability in admin/default.asp in Dusan Drobac CodeAvalanche FreeForum aka CAForum 1.0 allows remote attackers to execute arbitrary SQL commands via the password parameter...

CVE-2006-2822

CVE-2006-2822 describes a SQL injection in CodeAvalanche FreeForum 1.0 (admin/default.asp) that allows remote attackers to run arbitrary SQL via the password parameter. The NVD record assigns a CVSS v2 base score of 7.5 (HIGH) with network attack vector and no authentication, indicating potential...

CVE-2006-2822: Undefined Security Weakness

SQL injection vulnerability in admin/default.asp in Dusan Drobac CodeAvalanche FreeForum aka CAForum 1.0 allows remote attackers to execute arbitrary SQL commands via the password parameter...

EV0089.txt

New eVuln Advisory: FreeForum PHP Code Execution & Multiple XSS Vulnerabilities http://evuln.com/vulns/89/summary.html --------------------Summary---------------- eVuln ID: EV0089 CVE: CVE-2006-0957 CVE-2006-0958 Vendor: ZoneO-Soft Vendor's Web Site: http://soft.zoneo.net/ Software: FreeForum...

[eVuln] FreeForum PHP Code Execution & Multiple XSS Vulnerabilities

New eVuln Advisory: FreeForum PHP Code Execution & Multiple XSS Vulnerabilities http://evuln.com/vulns/89/summary.html --------------------Summary---------------- eVuln ID: EV0089 CVE: CVE-2006-0957 CVE-2006-0958 Vendor: ZoneO-Soft Vendor's Web Site: http://soft.zoneo.net/ Software: FreeForum...

Cross site scripting

Cross-site scripting XSS vulnerability in func.inc.php in ZoneO-Soft freeForum before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the 1 name and 2 subject parameters...

CVE-2006-0957

Direct static code injection vulnerability in func.inc.php in ZoneO-Soft freeForum before 1.2.1 allows remote attackers to execute arbitrary PHP code via the 1 X-Forwarded-For and 2 Client-Ip HTTP headers, which are stored in Data/flood.db.php...

CVE-2006-0958

Cross-site scripting XSS vulnerability in func.inc.php in ZoneO-Soft freeForum before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the 1 name and 2 subject parameters...

CVE-2006-0958

FreeForum by ZoneO-Soft (vendor: ZoneO-Soft) prior to version 1.2.1 is affected. CVE-2006-0958 stems from unsanitized inputs in func.inc.php, allowing cross-site scripting via the name and subject parameters. Related linked advisory EV0089 also describes a PHP code execution path through unvalida...

CVE-2006-0958

Cross-site scripting XSS vulnerability in func.inc.php in ZoneO-Soft freeForum before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the 1 name and 2 subject parameters...

CVE-2006-0957

CVE-2006-0957 affects ZoneO-Soft FreeForum (before 1.2.1). A direct static code injection vulnerability exists in func.inc.php where HTTP headers X-Forwarded-For and Client-Ip are written to Data/flood.db.php, enabling remote attackers to inject and execute arbitrary PHP code. The vulnerability a...

CVE-2006-0957: Undefined Security Weakness

Direct static code injection vulnerability in func.inc.php in ZoneO-Soft freeForum before 1.2.1 allows remote attackers to execute arbitrary PHP code via the 1 X-Forwarded-For and 2 Client-Ip HTTP headers, which are stored in Data/flood.db.php...

CVE-2006-0958: Undefined Security Weakness

Cross-site scripting XSS vulnerability in func.inc.php in ZoneO-Soft freeForum before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the 1 name and 2 subject parameters...

CVE-2005-3816

Multiple SQL injection vulnerabilities in forum.php in freeForum 1.1 and earlier and earlier allow remote attackers to execute arbitrary SQL commands via the 1 cat parameter or 2 thread parameter in thread mode...

CVE-2005-3816

CVE-2005-3816 describes multiple SQL injection vulnerabilities in freeForum 1.1 and earlier, exploitable via the cat or thread parameters in thread mode, allowing remote execution of arbitrary SQL commands. Affected product: freeForum (forum.php). Root cause: insufficient input handling leading t...

CVE-2005-3816: Undefined Security Weakness

Multiple SQL injection vulnerabilities in forum.php in freeForum 1.1 and earlier and earlier allow remote attackers to execute arbitrary SQL commands via the 1 cat parameter or 2 thread parameter in thread mode...