CVE-2008-5961: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in Tribiq CMS Community 5.0.10B and 5.0.11E allows remote attackers to inject arbitrary web script or HTML via the cID parameter in a document action. NOTE: the provenance of this information is unknown; the details are obtained solely from thir...

CVE-2008-5960: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in Tribiq CMS Community 5.0.10B and 5.0.11E allows remote attackers to execute arbitrary SQL commands via the cID parameter in a document action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

CVE-2008-5949: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in ccTiddly 1.7.4 and 1.7.6 allow remote attackers to execute arbitrary PHP code via a URL in the cctbase parameter to 1 index.php; 2 handle/proxy.php; 3 header.php, 4 include.php, and 5 workspace.php in includes/; and 6 plugins/RSS/files/rss.php...

CVE-2008-5948: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in BNCwi 1.04 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the newlanguage parameter...

CVE-2008-5957: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the Mydyngallery commydyngallery component 1.4.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the directory parameter to index.php...

CVE-2008-5940

SQL injection vulnerability in index.php in MODx 0.9.6.2 and earlier, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the searchid parameter. NOTE: some of these details are obtained from third party information...

CVE-2008-5940

MODx contains a SQL injection in index.php (MODx 0.9.6.2 and earlier) that can be triggered when magic_quotes_gpc is disabled, allowing a remote attacker to execute arbitrary SQL via the searchid parameter. Impact: remote attacker could obtain administrative privileges. Affected versions: 0.9.6.2...

CVE-2008-5939: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in MODx CMS 0.9.6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via a JavaScript event in the username field, possibly related to snippet.ditto.php. NOTE: some sources list the id parameter as being affected, but...

CVE-2008-5940: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in MODx 0.9.6.2 and earlier, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the searchid parameter. NOTE: some of these details are obtained from third party information...

Sql injection

Multiple SQL injection vulnerabilities in admin/usercheck.php in FlexPHPNews 0.0.6 allow remote attackers to execute arbitrary SQL commands via the 1 checkuser parameter aka username field or 2 checkpass parameter aka password field to admin/index.php. NOTE: some of these details are obtained fro...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in index.php in CMS ISWEB 3.0 allow remote attackers to inject arbitrary web script or HTML via 1 the strcerca parameter aka the input field for the cerca action or 2 the idoggetto parameter. NOTE: some of these details are obtained from third par...

CVE-2008-5934

SQL injection vulnerability in index.php in CMS ISWEB 3.0 allows remote attackers to execute arbitrary SQL commands via the idsezione parameter...

CVE-2008-5927

CVE-2008-5927 describes multiple SQL injection vulnerabilities in FlexPHPNews 0.0.6, specifically in admin/usercheck.php. The attack surface is the login path at admin/index.php, where user-supplied inputs in the checkuser (username) and checkpass (password) parameters appear to be unsafely handl...

CVE-2008-5934

CVE-2008-5934 describes a SQL injection vulnerability in the CMS ISWEB 3.0, specifically in the file index.php, where the parameter id_sezione can be manipulated to cause arbitrary SQL commands to be executed by an attacker. The vulnerability is exploitable remotely and can affect the confidentia...

CVE-2008-5918

Cross-site scripting XSS vulnerability in the getParameterisedSelfUrl function in index.php in WebSVN 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the PATHINFO...

CVE-2008-5918

The CVE-2008-5918 entry concerns a Cross-site scripting (XSS) in WebSVN 2.0 and earlier. According to Gentoo GLSA 200903-20 and related OPENVAS entries, the vulnerability affects the getParameterisedSelfUrl() function in index.php, enabling a remote attacker to inject arbitrary web script or HTML...

CVE-2008-5922: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in themes/default/index.php in Cant Find A Gaming CMS CFAGCMS 1 allow remote attackers to execute arbitrary PHP code via a URL in the 1 main and 2 right parameters...

CVE-2008-5918: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the getParameterisedSelfUrl function in index.php in WebSVN 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the PATHINFO...

CVE-2008-5934: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in CMS ISWEB 3.0 allows remote attackers to execute arbitrary SQL commands via the idsezione parameter...

CVE-2008-5933: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in index.php in CMS ISWEB 3.0 allow remote attackers to inject arbitrary web script or HTML via 1 the strcerca parameter aka the input field for the cerca action or 2 the idoggetto parameter. NOTE: some of these details are obtained from third par...